{"action":"Upgrade github.com/lestrrat-go/jwx to 1.2.26 or later.","affected":[{"fixed":"1.2.26","introduced":"0"}],"component":"github.com/lestrrat-go/jwx","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["1.2.26"],"ghsa_id":"GHSA-rm8v-mxj3-5rmq","id":"tcs_01M5KFMXRRYB35JH0MA2PZE6Z2","modified_at":"2023-11-08T04:22:49.387484Z","published_at":"2023-06-14T17:24:36Z","references":["https://osv.dev/vulnerability/GHSA-rm8v-mxj3-5rmq","https://github.com/lestrrat-go/jwx/security/advisories/GHSA-rm8v-mxj3-5rmq","https://github.com/lestrrat-go/jwx/commit/6c41e3822485fc7e11dd70b4b0524b075d66b103","https://github.com/lestrrat-go/jwx/commit/d9ddbc8e5009cfdd8c28413390b67afa7f576dd6","https://github.com/lestrrat-go/jwx","https://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66","https://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-rm8v-mxj3-5rmq#Go/github.com/lestrrat-go/jwx","url":"https://osv.dev/vulnerability/GHSA-rm8v-mxj3-5rmq"}],"summary":"github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack"}