samples icon indicating copy to clipboard operation
samples copied to clipboard
verified publisher icon ampproject

Update dependency jsonwebtoken to v9 [SECURITY]

Open renovate[bot] opened this issue 2 years ago • 1 comments

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
jsonwebtoken ^8.0.0 -> ^9.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-23540

Overview

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification.

Am I affected?

You will be affected if all the following are true in the jwt.verify() function:

  • a token with no signature is received
  • no algorithms are specified
  • a falsy (e.g. null, false, undefined) secret or key is passed

How do I fix it?

Update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method.

Will the fix impact my users?

There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Release Notes

auth0/node-jsonwebtoken (jsonwebtoken)

v9.0.0

Compare Source

Breaking changes: See Migration from v8 to v9

Breaking changes
  • Removed support for Node versions 11 and below.
  • The verify() function no longer accepts unsigned tokens by default. ([8345030]https://github.com/auth0/node-jsonwebtoken/commit/834503079514b72264fd13023a3b8d648afd6a16)
  • RSA key size must be 2048 bits or greater. ([ecdf6cc]https://github.com/auth0/node-jsonwebtoken/commit/ecdf6cc6073ea13a7e71df5fad043550f08d0fa6)
  • Key types must be valid for the signing / verification algorithm
Security fixes
  • security: fixes Arbitrary File Write via verify function - CVE-2022-23529
  • security: fixes Insecure default algorithm in jwt.verify() could lead to signature validation bypass - CVE-2022-23540
  • security: fixes Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - CVE-2022-23541
  • security: fixes Unrestricted key type could lead to legacy keys usage - CVE-2022-23539

v8.5.1

Compare Source

Bug fix
Docs

v8.5.0

Compare Source

New Functionality
Test Improvements
Docs

v8.4.0

Compare Source

New Functionality
Bug Fixes
Docs
Test Improvements
CI

v8.3.0

Compare Source

v8.2.2

Compare Source

v8.2.1

Compare Source

v8.2.0

Compare Source

v8.1.1

Compare Source

v8.1.0

Compare Source

v8.0.1

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Mar 18 '23 04:03 renovate[bot]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: amp-concert/package-lock.json

renovate[bot] avatar May 28 '23 23:05 renovate[bot]