Padding oracle vulnerability in github.com/lestrrat-go/jwx

GHSA-rm8v-mxj3-5rmq · GO-2023-1859 · Published 22/06/2023 · updated 20/05/2024

In short

GO-2023-1859 is a not yet rated vulnerability affecting github.com/lestrrat-go/jwx, github.com/lestrrat-go/jwx/v2.
Fix: update to 1.2.26, 2.0.11-0.20230614080639-c8b6bec919a1 or later.

Package	Affected versions	Patched versions
github.com/lestrrat-go/jwx Go	`< 1.2.26`	`1.2.26`
github.com/lestrrat-go/jwx/v2 Go	`< 2.0.11-0.20230614080639-c8b6bec919a1`	`2.0.11-0.20230614080639-c8b6bec919a1`

AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.