英文:
How to bypass cve-2020-26160 vulnerability in dgrijalva/jwt-go?
问题
容器安全状态在Gitlab流水线中未通过，因为存在一个高级漏洞。该漏洞是jwt-go，安装的版本是v3.2.0+incompatible。错误标题如下：jwt-go: 访问限制绕过漏洞-->avd.aquasec.com/nvd/cve-2020-26160。相关仓库的Go版本是1.16.3。我该如何修复这个漏洞？
英文:
Container Security state does not pass in Gitlab pipeline because of one high level vulnerability. This vulnerability is jwt-go and it's installed version is v3.2.0+incompatible. The error title like this: jwt-go: access restriction bypass vulnerability-->avd.aquasec.com/nvd/cve-2020-26160. The Go version of the relevant repo is 1.16.3. How can I fix this vulnerability?
答案1
得分: 2
CVE-2020-26160漏洞是由于dgrijalva/jwt-go错误地将JWT的aud字段建模为string，而根据JWT规范，它应该是一个字符串切片。
一般情况下，“aud”值是一个区分大小写的字符串数组。
你无法自行绕过它，因为这是库中的一个错误：https://github.com/dgrijalva/jwt-go/issues/428
切换到官方社区分支golang-jwt/jwt，它的v3.2.1修复了这个漏洞：https://github.com/golang-jwt/jwt/releases/tag/v3.2.1
- 导入路径更改：请参阅MIGRATION_GUIDE.md以获取有关更新代码的提示
将导入路径从github.com/dgrijalva/jwt-go更改为github.com/golang-jwt/jwt- 修复了VerifyAudience中的字符串和[]string之间的类型混淆问题（#12）。这修复了CVE-2020-26160
英文:
The CVE-2020-26160 vulnerability is due to the fact that dgrijalva/jwt-go incorrectly models the JWT aud field as a string, when based on the JWT specs it should be a slice of strings.
> In the general case, the "aud" value is an array of case-sensitive strings
You can't bypass it yourself, because it's a bug in the library: https://github.com/dgrijalva/jwt-go/issues/428
Switch to the official community fork golang-jwt/jwt, its v3.2.1 fixes the vulnerability: https://github.com/golang-jwt/jwt/releases/tag/v3.2.1
> - Import Path Change: See MIGRATION_GUIDE.md for tips on updating your code
Changed the import path from github.com/dgrijalva/jwt-go to github.com/golang-jwt/jwt
> - Fixed type confusion issue between string and []string in VerifyAudience (#12). This fixes CVE-2020-26160
答案2
得分: 0
github.com/dgrijalva/jwt-go在25天前解决了这个漏洞，你使用的版本（v3.2.0）是2018年的，更新到使用该库的最新版本应该可以解决所有JWT安全问题。
英文:
github.com/dgrijalva/jwt-go solved this vurnability 25 days ago, the version you use (v3.2.0) is from 2018, updating to use the latest version of that library should solve all the jwt security problem
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论