[Bug 1232951] New: VUL-0: CVE-2024-51744: traefik: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
https://bugzilla.suse.com/show_bug.cgi?id=1232951 Bug ID: 1232951 Summary: VUL-0: CVE-2024-51744: traefik: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/426863/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-51744:3.1:(AV:N/AC:H/PR:N/UI:R/ S:U/C:L/I:N/A:N) Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi@suse.com Reporter: andrea.mattiazzo@suse.com QA Contact: security-team@suse.de Blocks: 1232936 Target Milestone: --- Found By: --- Blocker: --- golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-51744 https://www.cve.org/CVERecord?id=CVE-2024-51744 https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060... https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r https://bugzilla.redhat.com/show_bug.cgi?id=2323735 -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232951 https://bugzilla.suse.com/show_bug.cgi?id=1232951#c1 --- Comment #1 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- The packages below are or contain embedded packages that are vulnerable to CVE-2024-51744: - openSUSE:Factory/traefik contains embedded package: github.com/golang-jwt/jwt/v4 (4.5.0) Please consider version bumping or patching the affected dependencies. The listed codestreams are affected. All other codestreams should not be affected, but feel free to double-check. This is a auto-generated message, please reach out to the reporter directly if you think this is incorrect. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232951 SMASH SMASH <smash_bz@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232951 https://bugzilla.suse.com/show_bug.cgi?id=1232951#c2 --- Comment #2 from Alexandre Vicenzi <alexandre.vicenzi@suse.com> --- Traefik does not have a direct dependency on github.com/golang-jwt/jwt/v4. I have found the following uses: JWT library is a dependency of github.com/Azure/go-autorest/autorest, which is a dependency of go-acme/lego, which is a dependency of Traefik. JWT library is a dependency of github.com/yandex-cloud/go-sdk, which is a dependency of go-acme/lego, which is a dependency of Traefik. In both cases, this should only affect users of Let's Encrypt certificate resolver with Azure or Yander Cloud as a DNS challenge provider, but I did not find any calls to jwt.Parse and jwt.ParseWithClaims in the files that use this library. Given the nature of this dependency, it might take a while until all dependencies and sub-dependencies are updated in Traefik. I could not find the affected code being used, it seems that this CVE does not affect Traefik or its dependencies at this moment. Given the low score of this CVE, this fix is not critical. The version in the bug is set to Leap 15.5, Traefik is not even in Leap, only in Tumbleweed. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1232951 https://bugzilla.suse.com/show_bug.cgi?id=1232951#c3 Andrea Mattiazzo <andrea.mattiazzo@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #3 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- Closing as dependency are now updated to 4.5.1 -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com