Go/github.com/lestrrat-go/jwx/v2: medium

github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack

Action: Upgrade github.com/lestrrat-go/jwx/v2 to 2.0.11 or later.

go get github.com/lestrrat-go/jwx/v2@v2.0.11

Affected

Fixed versions

Sources

• osv: GHSA-rm8v-mxj3-5rmq
• https://github.com/lestrrat-go/jwx/security/advisories/GHSA-rm8v-mxj3-5rmq
• https://github.com/lestrrat-go/jwx/commit/6c41e3822485fc7e11dd70b4b0524b075d66b103
• https://github.com/lestrrat-go/jwx/commit/d9ddbc8e5009cfdd8c28413390b67afa7f576dd6
• https://github.com/lestrrat-go/jwx
• https://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66
• https://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213

published 2023-06-14T17:24:36Z · modified 2023-11-08T04:22:49.387484Z · JSON