[release/2.7] github.com/golang-jwt/jwt v3.2.2 #3466

thaJeztah · 2021-07-29T12:55:01Z

closes #3465

relates to #3361
relates to #3459 (main branch)
alternative to #3465
closes #3465

~~Using the https://github.com/form3tech-oss/jwt-go.git, which is actively maintained.~~

~~full diff: form3tech-oss/jwt-go@a601269...v3.2.4~~

to address CVE-2020-26160

full diff: golang-jwt/jwt@a601269...v3.2.2

3.2.1 release notes

Import Path Change: See MIGRATION_GUIDE.md for tips on updating your code
Changed the import path from github.com/dgrijalva/jwt-go to github.com/golang-jwt/jwt
Fixed type confusion issue between string and []string in VerifyAudience.
This fixes CVE-2020-26160

3.2.2 release notes

Starting from this release, we are adopting the policy to support the most 2
recent versions of Go currently available. By the time of this release, this
is Go 1.15 and 1.16.
Fixed a potential issue that could occur when the verification of exp, iat
or nbf was not required and contained invalid contents, i.e. non-numeric/date.
Thanks for @thaJeztah for making us aware of that and @giorgos-f3 for originally
reporting it to the formtech fork.
Added support for EdDSA / ED25519.
Optimized allocations.

codecov-commenter · 2021-07-29T13:03:03Z

Codecov Report

Merging #3466 (2b076bf) into release/2.7 (18230b7) will not change coverage.
The diff coverage is n/a.

@@             Coverage Diff              @@
##           release/2.7    #3466   +/-   ##
============================================
  Coverage        58.77%   58.77%           
============================================
  Files              102      102           
  Lines             7085     7085           
============================================
  Hits              4164     4164           
  Misses            2280     2280           
  Partials           641      641

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 18230b7...2b076bf. Read the comment docs.

thaJeztah · 2021-07-29T13:08:01Z

From #3465 (comment)

Not against using a replace if vndr can do that. Should we consider using the fork which the original repository now links to? https://github.com/golang-jwt/jwt

Looks like there's another fork as well (and that's the "official" replacement?)

thaJeztah · 2021-07-29T13:20:24Z

vendor/github.com/dgrijalva/jwt-go/map_claims.go

-	exp, ok := m["exp"]
-	if !ok {
-		return !req
-	}
-	switch expType := exp.(type) {
+	switch exp := m["exp"].(type) {


Looks like the official repository does not have the security fix that the orm3tech-oss/jwt-go fork has; switching to github.com/golang-jwt/jwt removes these changes, which seem to be related to that security fix: form3tech-oss/jwt-go@v3.2.3...v3.2.4 (see form3tech-oss/jwt-go#14)

I believe golang-jwt/jwt v3.2.1 fixed CVE-2020-26160 with different code: golang-jwt/jwt@0f726ea

The equivalent to that one is in form3tech-oss/jwt-go@bb5e6d8 for the form3tech repository. Looks like v3.2.4 is fixing a different security issue?

In that case the fix for CVE-2020-26160 is in form3tech-oss/jwt.go v3.2.2 and both #3459 and #3465 do fix CVE-2020-26160.

Correct. I suspect no CVE has been requested for the security fix in form3tech-oss/jwt-go v3.2.4. If it's verified to be a security issue, a CVE should probably be requested (both for form3tech-oss/jwt-go, and for github.com/golang-jwt/jwt / dgrijalva/jwt-go)

Shall we merge those two PRs while we wait for the situation with this new vulerability to be resolved upstream or do you think the workaround in this PR is a better fix for right now?

My concern with #3465 is that it's pulling in 5.6k lines of code that's unrelated to the security fix (and which would have to be reviewed), with the goal to pull in a security fix that's < 50 lines. And (worse?) switching to a non-official fork (which, based on the go.mod addition, is at least somewhat "dubious" on quality).

From that perspective, I'd rather take the official fork (ideally with golang-jwt/jwt#40, if that's confirmed to be an issue), as is done in this PR.

For the main branch, I don't think there's an direct urgency to get it merged, unless a v3.0.0 release is pending.

thaJeztah · 2021-07-29T17:50:56Z

Looks like https://github.com/golang-jwt/jwt is the best option, and golang-jwt/jwt#40 is currently being reviewed, so I squashed the commits, and went for that fork (as it's the official replacement).

thaJeztah · 2021-07-30T23:18:31Z

Updated to v3.2.2, which was just released

thaJeztah · 2021-07-30T23:32:12Z

Looks like we need to update Golang as well;

/docker/distribution/vendor/github.com/dgrijalva/jwt-go/ecdsa.go:135:5: r.FillBytes undefined (type *big.Int has no field or method FillBytes

thaJeztah · 2021-07-30T23:47:03Z

ok, works with Go 1.16, but should be moved to a separate PR

thaJeztah · 2021-07-30T23:50:18Z

opened #3472

@thaJeztah

to address CVE-2020-26160 full diff: golang-jwt/jwt@a601269...v3.2.2 3.2.1 release notes --------------------------------------- - Import Path Change: See MIGRATION_GUIDE.md for tips on updating your code Changed the import path from github.com/dgrijalva/jwt-go to github.com/golang-jwt/jwt - Fixed type confusion issue between string and []string in VerifyAudience. This fixes CVE-2020-26160 3.2.2 release notes --------------------------------------- - Starting from this release, we are adopting the policy to support the most 2 recent versions of Go currently available. By the time of this release, this is Go 1.15 and 1.16. - Fixed a potential issue that could occur when the verification of exp, iat or nbf was not required and contained invalid contents, i.e. non-numeric/date. Thanks for @thaJeztah for making us aware of that and @giorgos-f3 for originally reporting it to the formtech fork. - Added support for EdDSA / ED25519. - Optimized allocations. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah · 2021-08-10T11:06:54Z

Rebased, because #3472 was merged

thaJeztah · 2021-08-13T11:28:17Z

Thinking a bit more about this PR: does this project actually perform the validation of the JWT token? Because if not, then this patch may not be needed at all

milosgajdos · 2021-11-17T19:54:23Z

@thaJeztah distribution has token auth package that does verification https://github.com/distribution/distribution/blob/release/2.7/registry/auth/token/token.go

thaJeztah · 2021-11-17T20:19:22Z

@thaJeztah distribution has token auth package that does verification

Ah, thanks for checking!

wy65701436

lgtm

thaJeztah mentioned this pull request Jul 29, 2021

[release/2.7 backport] remove github.com/dgrijalva/jwt-go #3465

Closed

thaJeztah changed the title ~~[release/2.7] vendor: github.com/dgrijalva|form3tech-oss/jwt-go v3.2.4~~ [release/2.7] github.com/golang-jwt/jwt v3.2.1 Jul 29, 2021

thaJeztah commented Jul 29, 2021

View reviewed changes

thaJeztah force-pushed the 2.7_update_jwt branch from 9c170a3 to 71b608f Compare July 29, 2021 17:49

thaJeztah added the security label Jul 29, 2021

thaJeztah mentioned this pull request Jul 30, 2021

upstream fix for security vulnerability from form3tech-oss/jwt-go fork golang-jwt/jwt#40

Merged

thaJeztah force-pushed the 2.7_update_jwt branch from 71b608f to 77892d6 Compare July 30, 2021 23:17

thaJeztah changed the title ~~[release/2.7] github.com/golang-jwt/jwt v3.2.1~~ [release/2.7] github.com/golang-jwt/jwt v3.2.2 Jul 30, 2021

thaJeztah force-pushed the 2.7_update_jwt branch from 2b076bf to 430c232 Compare July 30, 2021 23:47

thaJeztah mentioned this pull request Jul 30, 2021

[release/2.7] update to go1.16 #3472

Merged

thaJeztah force-pushed the 2.7_update_jwt branch from 430c232 to de4bb77 Compare July 30, 2021 23:50

thaJeztah force-pushed the 2.7_update_jwt branch from de4bb77 to c5679da Compare August 10, 2021 11:05

milosgajdos requested a review from wy65701436 November 17, 2021 20:15

milosgajdos approved these changes Nov 17, 2021

View reviewed changes

milosgajdos requested review from joaodrp and waynr November 18, 2021 08:47

wy65701436 approved these changes Nov 23, 2021

View reviewed changes

milosgajdos merged commit afe8542 into distribution:release/2.7 Nov 23, 2021

thaJeztah deleted the 2.7_update_jwt branch November 23, 2021 09:23

thaJeztah added this to the Registry/2.7.2 milestone Nov 23, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release/2.7] github.com/golang-jwt/jwt v3.2.2 #3466

[release/2.7] github.com/golang-jwt/jwt v3.2.2 #3466

thaJeztah commented Jul 29, 2021 •

edited

codecov-commenter commented Jul 29, 2021 •

edited

thaJeztah commented Jul 29, 2021

thaJeztah Jul 29, 2021 •

edited

brackendawson Jul 29, 2021

thaJeztah Jul 29, 2021

brackendawson Jul 29, 2021

thaJeztah Jul 29, 2021

brackendawson Jul 29, 2021

thaJeztah Jul 29, 2021

thaJeztah commented Jul 29, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Aug 10, 2021

thaJeztah commented Aug 13, 2021

milosgajdos commented Nov 17, 2021

thaJeztah commented Nov 17, 2021

wy65701436 left a comment

[release/2.7] github.com/golang-jwt/jwt v3.2.2 #3466

[release/2.7] github.com/golang-jwt/jwt v3.2.2 #3466

Conversation

thaJeztah commented Jul 29, 2021 • edited

3.2.1 release notes

3.2.2 release notes

codecov-commenter commented Jul 29, 2021 • edited

Codecov Report

thaJeztah commented Jul 29, 2021

thaJeztah Jul 29, 2021 • edited

Choose a reason for hiding this comment

brackendawson Jul 29, 2021

Choose a reason for hiding this comment

thaJeztah Jul 29, 2021

Choose a reason for hiding this comment

brackendawson Jul 29, 2021

Choose a reason for hiding this comment

thaJeztah Jul 29, 2021

Choose a reason for hiding this comment

brackendawson Jul 29, 2021

Choose a reason for hiding this comment

thaJeztah Jul 29, 2021

Choose a reason for hiding this comment

thaJeztah commented Jul 29, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Jul 30, 2021

thaJeztah commented Aug 10, 2021

thaJeztah commented Aug 13, 2021

milosgajdos commented Nov 17, 2021

thaJeztah commented Nov 17, 2021

wy65701436 left a comment

Choose a reason for hiding this comment

thaJeztah commented Jul 29, 2021 •

edited

codecov-commenter commented Jul 29, 2021 •

edited

thaJeztah Jul 29, 2021 •

edited