chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.1 [security] (release-v0.17)

[redhat-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/golang-jwt/jwt/v4	indirect	minor	v4.2.0 -> v4.5.1

---

Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt

CVE-2024-51744 / GHSA-29wx-vh33-7x7r / GO-2024-3250

More information

Details

Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt

Severity

Unknown

References

• https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r
• https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations

CVE-2024-51744 / GHSA-29wx-vh33-7x7r / GO-2024-3250

More information

Details

Summary

Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

Fix

We have back-ported the error handling logic from the v5 branch to the v4 branch. In this logic, the ParseWithClaims function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release.

Workaround

We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above.

token, err := /* jwt.Parse or similar */
if token.Valid {
	fmt.Println("You look nice today")
} else if errors.Is(err, jwt.ErrTokenMalformed) {
	fmt.Println("That's not even a token")
} else if errors.Is(err, jwt.ErrTokenUnverifiable) {
	fmt.Println("We could not verify this token")
} else if errors.Is(err, jwt.ErrTokenSignatureInvalid) {
	fmt.Println("This token has an invalid signature")
} else if errors.Is(err, jwt.ErrTokenExpired) || errors.Is(err, jwt.ErrTokenNotValidYet) {
	// Token is either expired or not active yet
	fmt.Println("Timing is everything")
} else {
	fmt.Println("Couldn't handle this token:", err)
}

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r
• https://nvd.nist.gov/vuln/detail/CVE-2024-51744
• https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c
• https://github.com/golang-jwt/jwt

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

golang-jwt/jwt (github.com/golang-jwt/jwt/v4)

v4.5.1

Compare Source

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

• Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

v4.5.0

Compare Source

What's Changed

• Allow strict base64 decoding by @​AlexanderYastrebov in https://github.com/golang-jwt/jwt/pull/259

Full Changelog: golang-jwt/jwt@v4.4.3...v4.5.0

v4.4.3

Compare Source

What's Changed

• fix: link update for README.md for v4 by @​krokite in https://github.com/golang-jwt/jwt/pull/217
• Implement a BearerExtractor by @​WhyNotHugo in https://github.com/golang-jwt/jwt/pull/226
• Bump matrix to support latest go version (go1.19) by @​mfridman in https://github.com/golang-jwt/jwt/pull/231
• Include https://github.com/golang-jwt/jwe in README by @​oxisto in https://github.com/golang-jwt/jwt/pull/229
• Add doc comment to ParseWithClaims by @​jkopczyn in https://github.com/golang-jwt/jwt/pull/232
• Refactor: removed the unneeded if statement by @​Krout0n in https://github.com/golang-jwt/jwt/pull/241
• No pointer embedding in the example by @​oxisto in https://github.com/golang-jwt/jwt/pull/255

New Contributors

• @​krokite made their first contribution in https://github.com/golang-jwt/jwt/pull/217
• @​WhyNotHugo made their first contribution in https://github.com/golang-jwt/jwt/pull/226
• @​jkopczyn made their first contribution in https://github.com/golang-jwt/jwt/pull/232
• @​Krout0n made their first contribution in https://github.com/golang-jwt/jwt/pull/241

Full Changelog: golang-jwt/jwt@v4.4.2...v4.4.3

v4.4.2

Compare Source

What's Changed

• Added MicahParks/keyfunc to extensions by @​oxisto in https://github.com/golang-jwt/jwt/pull/194
• Update link to v4 on pkg.go.dev page by @​polRk in https://github.com/golang-jwt/jwt/pull/195
• add installation guidelines to the README file by @​morelmiles in https://github.com/golang-jwt/jwt/pull/204
• chore: replace ioutil with io and os by @​estensen in https://github.com/golang-jwt/jwt/pull/198
• CI check for Go code formatting by @​mfridman in https://github.com/golang-jwt/jwt/pull/206
• Create SECURITY.md by @​mfridman in https://github.com/golang-jwt/jwt/pull/171
• Update SECURITY.md by @​oxisto in https://github.com/golang-jwt/jwt/pull/207
• Fixed integer overflow in NumericDate.MarshalJSON by @​qqiao in https://github.com/golang-jwt/jwt/pull/200
• Claims in rsa_test.go Table Driven Test are Unused by @​gkech in https://github.com/golang-jwt/jwt/pull/212

New Contributors

• @​polRk made their first contribution in https://github.com/golang-jwt/jwt/pull/195
• @​morelmiles made their first contribution in https://github.com/golang-jwt/jwt/pull/204
• @​estensen made their first contribution in https://github.com/golang-jwt/jwt/pull/198
• @​qqiao made their first contribution in https://github.com/golang-jwt/jwt/pull/200
• @​gkech made their first contribution in https://github.com/golang-jwt/jwt/pull/212

Full Changelog: golang-jwt/jwt@v4.4.1...v4.4.2

v4.4.1

Compare Source

What's Changed

• Add go1.18 to ci pipeline by @​mfridman in https://github.com/golang-jwt/jwt/pull/173
• Revert "feat: port clockskew support (#​139)" by @​mfridman in https://github.com/golang-jwt/jwt/pull/184

Note, this release contains a Go module retraction for a prior release v4.4.0:

retract (
    v4.4.0 // Contains a backwards incompatible change to the Claims interface.
)

Full Changelog: golang-jwt/jwt@v4.4.0...v4.4.1

v4.4.0

Compare Source

What's Changed

• fix: expired token error message by @​ydylla in https://github.com/golang-jwt/jwt/pull/165
• feat: port clockskew support by @​ksegun in https://github.com/golang-jwt/jwt/pull/139

New Contributors

• @​ydylla made their first contribution in https://github.com/golang-jwt/jwt/pull/165
• @​ksegun made their first contribution in https://github.com/golang-jwt/jwt/pull/139

Full Changelog: golang-jwt/jwt@v4.3.0...v4.4.0

v4.3.0

Compare Source

What's Changed

• Support errors.Is for token extractors by @​stefantds in https://github.com/golang-jwt/jwt/pull/141
• Implementing Is(err) bool to support Go 1.13 style error checking by @​oxisto in https://github.com/golang-jwt/jwt/pull/136
• remove unnecessary for loop in token signing string for readability by @​hyeonjae in https://github.com/golang-jwt/jwt/pull/34
• updated README.md to contain more extensions by @​matelang in https://github.com/golang-jwt/jwt/pull/155
• Add JWT logo attribution by @​mfridman in https://github.com/golang-jwt/jwt/pull/161
• fix: fixed typo detect by cSpell by @​giautm in https://github.com/golang-jwt/jwt/pull/164
• Set json encoding precision by @​mfridman in https://github.com/golang-jwt/jwt/pull/162

New Contributors

• @​stefantds made their first contribution in https://github.com/golang-jwt/jwt/pull/141
• @​hyeonjae made their first contribution in https://github.com/golang-jwt/jwt/pull/34
• @​matelang made their first contribution in https://github.com/golang-jwt/jwt/pull/155
• @​giautm made their first contribution in https://github.com/golang-jwt/jwt/pull/164

Full Changelog: golang-jwt/jwt@v4.2.0...v4.3.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[akrejcir]

/approve

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: akrejcir

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [akrejcir]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ksimon1]

/retest
/lgtm

[kubevirt-bot]

New changes are detected. LGTM label has been removed.

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[openshift-ci]

@redhat-renovate-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-single-node-functests	f83498b	link	true	/test e2e-single-node-functests
ci/prow/e2e-upgrade-functests	f83498b	link	true	/test e2e-upgrade-functests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.