Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate to golang-jwt #1121

Closed
senorprogrammer opened this issue Oct 9, 2021 · 3 comments · Fixed by #1135
Closed

Migrate to golang-jwt #1121

senorprogrammer opened this issue Oct 9, 2021 · 3 comments · Fixed by #1135
Labels
🚨 Security

Comments

@senorprogrammer
Copy link
Collaborator

What should it do?

Migrate from jwt-go to golang-jwt because of security issues.

See this report for details https://github.com/wtfutil/wtf/security/dependabot/go.sum/github.com%2Fdgrijalva%2Fjwt-go/open
@siddhant94
Copy link
Contributor

siddhant94 commented Oct 14, 2021 •
edited
Loading

Hi @senorprogrammer , the link for the dependabot report is broken so I am unable to see which CVE is mentioned.
I think this version release would fix the issue - https://github.com/golang-jwt/jwt/releases/tag/v3.2.1

Also, can you point me to Contributions doc on how to raise PR for any issue, also build tests etc.

PS: New to contributions in general and go modules.

@senorprogrammer
Copy link
Collaborator Author

It's this one GHSA-w73w-5m7g-f7qc

And to contribute, create a PR with the changes and make sure the existing tests pass 🙂

If you need any help with Go or tooling, feel free to ask on this issue, or in the Slack channel.

siddhant94 pushed a commit to siddhant94/wtf that referenced this issue Oct 17, 2021
Fixes wtfutil#1121
88ed1cd 
Replace transitive dependency of dgrijalva/jwt-go to golang-jwt/jwt to mitigate auth bypass (CVE-2020-26160)
@siddhant94 siddhant94 mentioned this issue Oct 17, 2021
Merged
@siddhant94
Copy link
Contributor

I have raised the PR. Let me know if something else needs to be done here.

senorprogrammer pushed a commit that referenced this issue Oct 21, 2021
@siddhant94
Fixes #1121 (#1135)
639f65b 
Replace transitive dependency of dgrijalva/jwt-go to golang-jwt/jwt to mitigate auth bypass (CVE-2020-26160)

Co-authored-by: Siddhant Sinha <sid_ideapad@pop-os.localdomain>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
🚨 Security
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fixes #1121 siddhant94/wtf
2 participants
@senorprogrammer @siddhant94