Improper Authentication in jwt-go - CVE-2020-26160

Vulnerability identifier: #VU50809

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26160

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper validation when processing data passed via m["aud"]. A remote attacker can pass the []string{} string, which is allowed by the specification, however treated as an empty string and bypass authentication checks.

jwt-go
WAL-G
Red Hat OpenShift Serverless
IBM Security Guardium Insights
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Edge Application Manager
IBM Watson Machine Learning Accelerator

Install updates from vendor's website.

jwt-go - update to 4.0.0-preview1
WAL-G - update to 3.0.0
Red Hat OpenShift Serverless - update to 1.13.0
IBM Security Guardium Insights - update to 3.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.7
IBM Watson Machine Learning Accelerator - update to 2.3.9

• https://github.com/dgrijalva/jwt-go/pull/426
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
• https://github.com/dgrijalva/jwt-go/issues/422

• Authentication bypass in jwt-go
• OpenShift Serverless update for jwt-go
• Authentication bypass in IBM Security Guardium Insights
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for jwt-go
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Improper Authentication in wal-g