This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-26160 →

DEBIAN-CVE-2020-26160

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by t...

Original description

The description as published by the source.

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 golang-github-dgrijalva-jwt-go

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-3"}]}]

References

advisory security-tracker.debian.org