Go/github.com/robbert229/jwt CVE-2015-10004: high 7.5, EPSS 0.81%

robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison

Action: Upgrade github.com/robbert229/jwt to 0.0.0-20170426191122-ca1404ee6e83 or later.

go get github.com/robbert229/jwt@v0.0.0-20170426191122-ca1404ee6e83

Affected

Fixed versions

Sources

• osv: GHSA-5vw4-v588-pgv8
• https://nvd.nist.gov/vuln/detail/CVE-2015-10004
• https://github.com/robbert229/jwt/issues/12
• https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654
• https://github.com/robbert229/jwt
• https://pkg.go.dev/vuln/GO-2020-0023

CVE-2015-10004 · published 2022-12-28T00:30:23Z · modified 2024-05-20T19:41:55Z · JSON