—
GO-2020-0023
Timing side-channel in github.com/robbert229/jwt
Quick fix
GO-2020-0023 — github.com/robbert229/jwt: upgrade to the fixed version with the command below.
go get github.com/robbert229/jwt@v0.0.0-20170426191122-ca1404ee6e83Details
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/robbert229/jwt
Introduced in:
0Fixed in: 0.0.0-20170426191122-ca1404ee6e83Fix
go get github.com/robbert229/jwt@v0.0.0-20170426191122-ca1404ee6e83