jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Library home page: https://proxy.golang.org/github.com/dgrijalva/jwt-go/@v/v3.2.0+incompatible.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Found in HEAD commit: d84c7024cb8f50e05bf9ef82c5d0e6df8328d7a0
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2020-26160
### Vulnerable Library - github.com/dgrijalva/jwt-go-v3.2.0+incompatibleLibrary home page: https://proxy.golang.org/github.com/dgrijalva/jwt-go/@v/v3.2.0+incompatible.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Dependency Hierarchy: - :x: **github.com/dgrijalva/jwt-go-v3.2.0+incompatible** (Vulnerable Library)
Found in HEAD commit: d84c7024cb8f50e05bf9ef82c5d0e6df8328d7a0
Found in base branch: main
### Vulnerability Detailsjwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Publish Date: 2020-09-30
URL: CVE-2020-26160
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-26160
Release Date: 2020-09-30
Fix Resolution: github.com/zamicol/jwt-go - 71c946872a592cce137f70cbd015aa8fcf7c96d5,v1.0.0;github.com/jarema/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/e-dard/jwt-go - v1.0.0;github.com/kevinburke/h256only - 4.0.0;github.com/mdanzinger/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/form3tech-oss/jwt-go - v3.2.1;github.com/channelmeter/jwt-go - v1.0.0;github.com/ssgreg/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/aldgate-ventures/jwt-go - v1.0.0;github.com/nanjishidu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/mathieulesniak/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/thomdixon/jwt-go - v1.0.0;github.com/jmsleiman/jwt-go - v1.0.0;github.com/zkfy/jwt-go - v1.0.0;github.com/taylorchu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/digitallumens/jwt-go - v1.0.0;github.com/jimmy99/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/fredbi/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/yunzhanghuopen/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/jchorl/jwt-go - v1.0.0;github.com/vladimiroff/jwt-go - v1.0.0;github.com/ti/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/dgrijalva/jwt-go - v1.0.0;github.com/benitogf/jwt - bb45bfcdecac35b6afa09673bd17a780b258a541;github.com/melonwool/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/leetal/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/kostozyb/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/jamescun/jwt-go - v1.0.0;github.com/kyf/jwt-go - v1.0.0;github.com/sliide/jwt-go - v1.0.0;github.com/yacen/alg - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/someone1/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/helmutkemper/jwt-go - v1.0.0;github.com/kazhuravlev/jwt-go - v1.0.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.