CVE-2024-21664

[sbko]

The latest release is affected by https://nvd.nist.gov/vuln/detail/CVE-2024-21664

CVE-2024-21664 | Anchore CVE | High | github.com/lestrrat-go/jwx-v1.2.28

[nacx]

Thanks for reporting! According to the linked CVE description:

This vulnerability has been patched in versions 2.0.19 and 1.2.28.

And in version 1.0.1 we're already using 1.2.28:

authservice-go/go.mod

Line 10 in df98bc5

github.com/lestrrat-go/jwx v1.2.28

Shouldn't that version already contain the patch for that CVE?

[nacx]

@sbko we've merged #80 that upgrades JWX to v2. Could you check if the latest main branch still reports the CVE?

[sbko]

@nacx could you cut a release so I can test it in Ironbank?