search

scm-automation-project / go-mod-simple-project

0 stars 0 forks source link

github.com/dgrijalva/jwt-go-v3.2.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed #2

Closed dev-mend-for-github-com[bot] closed 1 year ago

dev-mend-for-github-com[bot] commented 2 years ago
Vulnerable Library - github.com/dgrijalva/jwt-go-v3.2.0

Golang implementation of JSON Web Tokens (JWT)

Found in HEAD commit: d84c7024cb8f50e05bf9ef82c5d0e6df8328d7a0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2020-26160 High 7.5 github.com/dgrijalva/jwt-go-v3.2.0 Direct github.com/zamicol/jwt-go - 71c946872a592cce137f70cbd015aa8fcf7c96d5,v1.0.0;github.com/jarema/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/e-dard/jwt-go - v1.0.0;github.com/kevinburke/h256only - 4.0.0;github.com/mdanzinger/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/form3tech-oss/jwt-go - v3.2.1;github.com/channelmeter/jwt-go - v1.0.0;github.com/ssgreg/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/aldgate-ventures/jwt-go - v1.0.0;github.com/nanjishidu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/mathieulesniak/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/thomdixon/jwt-go - v1.0.0;github.com/jmsleiman/jwt-go - v1.0.0;github.com/zkfy/jwt-go - v1.0.0;github.com/taylorchu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/digitallumens/jwt-go - v1.0.0;github.com/jimmy99/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/fredbi/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/yunzhanghuopen/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/jchorl/jwt-go - v1.0.0;github.com/vladimiroff/jwt-go - v1.0.0;github.com/ti/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/dgrijalva/jwt-go - v1.0.0;github.com/benitogf/jwt - bb45bfcdecac35b6afa09673bd17a780b258a541;github.com/melonwool/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/leetal/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/kostozyb/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/jamescun/jwt-go - v1.0.0;github.com/kyf/jwt-go - v1.0.0;github.com/sliide/jwt-go - v1.0.0;github.com/yacen/alg - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/someone1/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/helmutkemper/jwt-go - v1.0.0;github.com/kazhuravlev/jwt-go - v1.0.0 ❌

Details

CVE-2020-26160 ### Vulnerable Library - github.com/dgrijalva/jwt-go-v3.2.0

Golang implementation of JSON Web Tokens (JWT)

Dependency Hierarchy: - :x: **github.com/dgrijalva/jwt-go-v3.2.0** (Vulnerable Library)

Found in HEAD commit: d84c7024cb8f50e05bf9ef82c5d0e6df8328d7a0

### Vulnerability Details

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Publish Date: 2020-09-30

URL: CVE-2020-26160

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-26160

Release Date: 2020-09-30

Fix Resolution: github.com/zamicol/jwt-go - 71c946872a592cce137f70cbd015aa8fcf7c96d5,v1.0.0;github.com/jarema/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/e-dard/jwt-go - v1.0.0;github.com/kevinburke/h256only - 4.0.0;github.com/mdanzinger/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/form3tech-oss/jwt-go - v3.2.1;github.com/channelmeter/jwt-go - v1.0.0;github.com/ssgreg/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/aldgate-ventures/jwt-go - v1.0.0;github.com/nanjishidu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/mathieulesniak/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/thomdixon/jwt-go - v1.0.0;github.com/jmsleiman/jwt-go - v1.0.0;github.com/zkfy/jwt-go - v1.0.0;github.com/taylorchu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/digitallumens/jwt-go - v1.0.0;github.com/jimmy99/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/fredbi/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/yunzhanghuopen/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/jchorl/jwt-go - v1.0.0;github.com/vladimiroff/jwt-go - v1.0.0;github.com/ti/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/dgrijalva/jwt-go - v1.0.0;github.com/benitogf/jwt - bb45bfcdecac35b6afa09673bd17a780b258a541;github.com/melonwool/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/leetal/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/kostozyb/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/jamescun/jwt-go - v1.0.0;github.com/kyf/jwt-go - v1.0.0;github.com/sliide/jwt-go - v1.0.0;github.com/yacen/alg - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/someone1/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/helmutkemper/jwt-go - v1.0.0;github.com/kazhuravlev/jwt-go - v1.0.0

dev-mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.