jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
CVE-2020-26160 - High Severity Vulnerability
github.com/dgrijalva/jwt-go-v3.2.0
Golang implementation of JSON Web Tokens (JWT)
Dependency Hierarchy: - :x: **github.com/dgrijalva/jwt-go-v3.2.0** (Vulnerable Library)
github.com/go-gitea/gitea-v1.2.3
Git with a cup of tea, painless self-hosted git service
Dependency Hierarchy: - :x: **github.com/go-gitea/gitea-v1.2.3** (Vulnerable Library)
Found in HEAD commit: 69a84c862836bec3e4be9a461b9e320cda5aeb94
Found in base branch: master
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Publish Date: 2020-09-30
URL: CVE-2020-26160
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-26160
Release Date: 2020-09-30
Fix Resolution: github.com/zamicol/jwt-go - 71c946872a592cce137f70cbd015aa8fcf7c96d5,v1.0.0;github.com/jarema/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/e-dard/jwt-go - v1.0.0;github.com/kevinburke/h256only - 4.0.0;github.com/mdanzinger/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/form3tech-oss/jwt-go - v3.2.1;github.com/channelmeter/jwt-go - v1.0.0;github.com/ssgreg/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/aldgate-ventures/jwt-go - v1.0.0;github.com/nanjishidu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/mathieulesniak/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/thomdixon/jwt-go - v1.0.0;github.com/jmsleiman/jwt-go - v1.0.0;github.com/zkfy/jwt-go - v1.0.0;github.com/taylorchu/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/digitallumens/jwt-go - v1.0.0;github.com/jimmy99/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/fredbi/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/yunzhanghuopen/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/jchorl/jwt-go - v1.0.0;github.com/vladimiroff/jwt-go - v1.0.0;github.com/ti/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/dgrijalva/jwt-go - v1.0.0;github.com/benitogf/jwt - bb45bfcdecac35b6afa09673bd17a780b258a541;github.com/melonwool/jwt-go - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/leetal/jwt-go - d8c133f5585dd19433ae7a9849ea7f615b30e134;github.com/kostozyb/jwt-go - 3c771ce311b7f51c2fa84ef4438cce09c9984444;github.com/jamescun/jwt-go - v1.0.0;github.com/kyf/jwt-go - v1.0.0;github.com/sliide/jwt-go - v1.0.0;github.com/yacen/alg - ebb248e1cb3ce18337386ffbc4e35e37739105ae;github.com/someone1/jwt-go - de0a819d8dadfba7a8f666d3c80b72c7a9a2bd45;github.com/helmutkemper/jwt-go - v1.0.0;github.com/kazhuravlev/jwt-go - v1.0.0