@ripienaar I'm aware that form3tech-oss promptly fixed it in their fork of jwt-go when I notified them, and I see that it is now also fixed in golang-jwt/jwt. Nevertheless, many projects still depend on dgrijalva/jwt-go, so as long as it isn't also fixed here, I should at some point make a public disclosure with the advice to use one of the maintained forks. To my knowledge, your comment is the first public link from the CVE number to the details of the vulnerability, so I might as well do it now. It has been 3 months, anyway.

Hi, one of the maintainers of golang-jwt/jwt here. I was just stumbling on this thread here from golang-jwt/jwt#185. Unfortunately, no public information is available (yet) on this CVE and I do not have any further non-public information. Would you mind disclosing more details to me at security-jwt@christian-banse.de, even though you mentioned we already fixed the issue anyway?

We are also in the process to set up a mailing list for security issues (see golang-jwt/jwt#171).

CVE-2021-33890 #482

Description

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions