GO-2020-0017
Authorization bypass in github.com/dgrijalva/jwt-go
At a glance
- Published
- Updated
- CVE
- CVE-2020-26160
- Aliases
- GHSA-w73w-5m7g-f7qc, SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
Description
If a JWT contains an audience claim with an array of strings, rather than a single string, and MapClaims.VerifyAudience is called with req set to false, then audience verification will be bypassed, allowing an invalid set of audiences to be provided.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/dgrijalva/jwt-go | introduced 0.0.0-20150717181359-44718f8a89b0 |
| Go · github.com/dgrijalva/jwt-go/v4 | introduced 0, fixed 4.0.0-preview1 |
References
- https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab FIX
- https://github.com/dgrijalva/jwt-go/issues/422 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |