New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bump jwt-go from 3.2.0 to 4.0.0-preview1 #1641

Closed

rgsurfs opened this issue Nov 19, 2021 · 1 comment

rgsurfs commented Nov 19, 2021

bump jwt-go from 3.2.0 to 4.0.0-preview1

Request review and update the bump jwt-go to latest supported version.

Latest versions may be found here:
https://github.com/dgrijalva/jwt-go/
dgrijalva/jwt-go#426

jwt-go v3.2.0 is vulnerable to the following CVEs:
https://nvd.nist.gov/vuln/detail/CVE-2020-26160

Vulnerabilities identified using Prisma Twistlock Scans conducted on 10 November 2021.

Owner

42wim commented Dec 11, 2021

We're using github.com/golang-jwt/jwt v3.2.2+incompatible which has the fixes.

42wim closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment