[GitHub] [pulsar-client-go] stormeyes opened a new issue #675: should change dgrijalva/jwt-go to golang-jwt/jwt in oauth2/go.mod

[GitBox <gi...@apache.org>]

stormeyes opened a new issue #675:
URL: https://github.com/apache/pulsar-client-go/issues/675


   **Is your feature request related to a problem? Please describe.**
   The oauth2/go.mod require github.com/form3tech-oss/jwt-go v3.2.3+incompatible should update to community maintained version: github.com/golang-jwt/jwt, which now in active development, you can see this issue for more detail https://github.com/dgrijalva/jwt-go/issues/474
   
   **Describe the solution you'd like**
   Just simply change the dependency from github.com/form3tech-oss/jwt-go to github.com/golang-jwt/jwt
   
   **Describe alternatives you've considered**
   no.
   
   **Additional context**
   no.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar-client-go] wolfstudy closed issue #675: should change dgrijalva/jwt-go to golang-jwt/jwt in oauth2/go.mod

[GitBox <gi...@apache.org>]

wolfstudy closed issue #675:
URL: https://github.com/apache/pulsar-client-go/issues/675


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar-client-go] zzzming commented on issue #675: should change dgrijalva/jwt-go to golang-jwt/jwt in oauth2/go.mod

[GitBox <gi...@apache.org>]

zzzming commented on issue #675:
URL: https://github.com/apache/pulsar-client-go/issues/675#issuecomment-1015574178


   This has been picked up this CVE with high severity.
   CVE-2020-26160
   high severity
   Vulnerable versions: <= 3.2.0
   Patched version: No fix
   jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to golang-jwt at version 3.2.1


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org