Skip to content

chore(deps): update dependency jsonwebtoken to 9.0.0 [security] - #16

Merged
marcusrbrown merged 1 commit into
mainfrom
renovate/npm-jsonwebtoken-vulnerability
Jan 8, 2023
Merged

chore(deps): update dependency jsonwebtoken to 9.0.0 [security]#16
marcusrbrown merged 1 commit into
mainfrom
renovate/npm-jsonwebtoken-vulnerability

Conversation

@bfra-me

@bfra-mebfra-meBot commented Jan 6, 2023

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChange
jsonwebtoken8.5.1 -> 9.0.0

GitHub Vulnerability Alerts

CVE-2022-23539

Overview

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.

Am I affected?

You are affected if you are using an algorithm and a key type other than the combinations mentioned below

Key typealgorithm
ecES256, ES384, ES512
rsaRS256, RS384, RS512, PS256, PS384, PS512
rsa-pssPS256, PS384, PS512

And for Elliptic Curve algorithms:

algCurve
ES256prime256v1
ES384secp384r1
ES512secp521r1

How do I fix it?

Update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, If you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Will the fix impact my users?

There will be no impact, if you update to version 9.0.0 and you already use a valid secure combination of key type and algorithm. Otherwise, use the allowInvalidAsymmetricKeyTypes option to true in the sign() and verify() functions to continue usage of invalid key type/algorithm combination in 9.0.0 for legacy compatibility.

CVE-2022-23541

Overview

Versions <=8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function (referring to the secretOrPublicKey argument from the readme link) will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens.

Am I affected?

You will be affected if your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function.

How do I fix it?

Update to version 9.0.0.

Will the fix impact my users?

There is no impact for end users

CVE-2022-23540

Overview

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification.

Am I affected?

You will be affected if you do not specify algorithms in the jwt.verify() function

How do I fix it?

Update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method.

Will the fix impact my users?

There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

CVE-2022-23529

Overview

For versions <=8.5.1 of jsonwebtoken library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the secretOrPublicKey argument from the readme link) of the jwt.verify() function, they can gain remote code execution (RCE).

Am I affected?

You are affected only if you allow untrusted entities to modify the key retrieval parameter of the jwt.verify() on a host that you control.

How do I fix it?

Update to version 9.0.0

Will the fix impact my users?

The fix has no impact on end users.

Credits

Palo Alto Networks

Configuration

📅 Schedule: Branch creation - "" in timezone America/Phoenix, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@bfra-mebfra-meBot added the security Security label Jan 6, 2023
@marcusrbrown
marcusrbrown merged commit a16a049 into mainJan 8, 2023
@marcusrbrown
marcusrbrown deleted the renovate/npm-jsonwebtoken-vulnerability branch January 8, 2023 06:49
bfra-meBot added a commit that referenced this pull request Aug 30, 2023
@bfra-me
build(release): compiled action for 1.0.0 [skip ci]\n\n## 1.0.0 (2023…
ce85b9b
…-08-30)
### Features
* add Prettier ([#30](#30)) ([9f67637](9f67637))
* initial version ([3cf3279](3cf3279))
* merge from bfra-me/feat/merge-from-template ([#13](#13)) ([ec107dd](ec107dd))
* merge upstream template into main ([1e9f425](1e9f425))
* move Node.js version into `package.json` ([#31](#31)) ([96ccede](96ccede))
* probot v11 ([#3](#3)) ([7bc9e68](7bc9e68))
* rejigger ([#24](#24)) ([0734ac7](0734ac7))
* use [@bfra-me](https://github.com/bfra-me) Renovate preset ([#2](#2)) ([32b5865](32b5865))
* use `@probot/github-action` adapter ([#15](#15)) ([290847c](290847c))
### Bug Fixes
* **ci:** use app token for entire release ([#42](#42)) ([1315016](1315016))
* **deps:** bump @probot/adapter-github-actions from 3.0.0 to 3.0.1 ([3b8fbf4](3b8fbf4))
* **deps:** bump @probot/adapter-github-actions from 3.0.1 to 3.1.0 ([0b52ed2](0b52ed2))
* **deps:** bump @probot/adapter-github-actions from 3.1.0 to 3.1.1 ([2fbe0fe](2fbe0fe))
* **deps:** bump probot from 11.0.5 to 11.0.6 ([1c55a4c](1c55a4c))
* **deps:** pin dependencies ([82ce839](82ce839))
* **deps:** update dependency probot to v12.3.1 ([3e0c19d](3e0c19d))
* get releases working ([#34](#34)) ([7641ccd](7641ccd))
* install Node LTS for `semantic-release` ([#27](#27)) ([1f3b907](1f3b907))
* **release:** move `message` key into the correct spot ([#36](#36)) ([af9b445](af9b445))
### Documentation
* **README:** note on bundling GitHub Action ([c2afb0c](c2afb0c))
* **README:** see the action in ... action ([6aff85e](6aff85e))
* **README:** typo ([2823d77](2823d77))
* **README:** typo ([#55](#55)) ([d2b2046](d2b2046))
### Miscellaneous Chores
* **deps:** lock file maintenance ([7ed8ffe](7ed8ffe))
* **deps:** lock file maintenance ([49deafa](49deafa))
* **deps:** lock file maintenance ([6bfe9f4](6bfe9f4))
* **deps:** lock file maintenance ([e8082ac](e8082ac))
* **deps:** lock file maintenance ([8413a7a](8413a7a))
* **deps:** lock file maintenance ([5848a44](5848a44))
* **deps:** lock file maintenance ([0f63f53](0f63f53))
* **deps:** lock file maintenance ([e432530](e432530))
* **deps:** lock file maintenance ([e006cba](e006cba))
* **deps:** lock file maintenance ([88ad1a6](88ad1a6))
* **deps:** lock file maintenance ([8be8b01](8be8b01))
* **deps:** lock file maintenance ([423ecb7](423ecb7))
* **deps:** lock file maintenance ([#6](#6)) ([c793c4b](c793c4b))
* **deps:** lock file maintenance [automerge] ([6efcefc](6efcefc))
* **deps:** pin dependency conventional-changelog-conventionalcommits to 6.1.0 ([ebc8383](ebc8383))
* **deps:** pin node.js to 16.20.0 ([082dfbe](082dfbe))
* **deps:** replace dependency @zeit/ncc with @vercel/ncc ^0.23.0 ([#18](#18)) ([2fc1b8a](2fc1b8a))
* **deps:** update actions/checkout action to v2.5.0 ([9e9f7b1](9e9f7b1))
* **deps:** update actions/checkout action to v3 ([#4](#4)) ([57bbbb8](57bbbb8))
* **deps:** update actions/checkout action to v3.2.0 ([c7439b7](c7439b7))
* **deps:** update actions/checkout action to v3.3.0 ([0108abe](0108abe))
* **deps:** update actions/checkout action to v3.4.0 ([d4e1a1a](d4e1a1a))
* **deps:** update actions/checkout action to v3.5.0 ([2b7183b](2b7183b))
* **deps:** update actions/checkout action to v3.5.1 ([872a75d](872a75d))
* **deps:** update actions/checkout action to v3.5.2 ([4776137](4776137))
* **deps:** update actions/checkout action to v3.5.3 ([1830a08](1830a08))
* **deps:** update actions/checkout action to v3.6.0 ([c16dc3d](c16dc3d))
* **deps:** update actions/setup-node action to v2.5.1 ([1581323](1581323))
* **deps:** update actions/setup-node action to v3 ([#5](#5)) ([dc30373](dc30373))
* **deps:** update actions/setup-node action to v3.6.0 ([0e06d18](0e06d18))
* **deps:** update actions/setup-node action to v3.7.0 ([7fdd1ad](7fdd1ad))
* **deps:** update actions/setup-node action to v3.8.0 ([9f390cc](9f390cc))
* **deps:** update actions/setup-node action to v3.8.1 ([7b2a5b3](7b2a5b3))
* **deps:** update dependency @vercel/ncc to ^0.36.0 ([#19](#19)) ([2456122](2456122))
* **deps:** update dependency http-cache-semantics to 4.1.1 [security] ([#20](#20)) ([d63626b](d63626b))
* **deps:** update dependency http-cache-semantics to 4.1.1 [security] ([#21](#21)) ([94ba5d0](94ba5d0))
* **deps:** update dependency http-cache-semantics to 4.1.1 [security] ([#22](#22)) ([978230c](978230c))
* **deps:** update dependency jsonwebtoken to 9.0.0 [security] ([#16](#16)) ([a16a049](a16a049))
* **deps:** update dependency nock to v13.3.1 ([#29](#29)) ([c585df7](c585df7))
* **deps:** update dependency nock to v13.3.2 ([215ad01](215ad01))
* **deps:** update dependency nock to v13.3.3 ([8aa2704](8aa2704))
* **deps:** update dependency prettier to v3 ([#37](#37)) ([5a97557](5a97557))
* **deps:** update dependency prettier to v3.0.1 ([c82276c](c82276c))
* **deps:** update dependency prettier to v3.0.2 ([0316914](0316914))
* **deps:** update dependency prettier to v3.0.3 ([6ea6d76](6ea6d76))
* **deps:** update dependency semantic-release to v20 ([#17](#17)) ([11917de](11917de))
* **deps:** update dependency semantic-release to v20.1.1 ([5fd2eae](5fd2eae))
* **deps:** update dependency semantic-release to v20.1.3 ([12b185c](12b185c))
* **deps:** update dependency semantic-release to v21 ([#25](#25)) ([c1e05f1](c1e05f1))
* **deps:** update dependency semantic-release to v21.0.3 ([b86344a](b86344a))
* **deps:** update dependency semantic-release to v21.0.4 ([270b678](270b678))
* **deps:** update dependency semantic-release to v21.0.5 ([bf6016f](bf6016f))
* **deps:** update dependency semantic-release to v21.0.6 ([c7d75b4](c7d75b4))
* **deps:** update dependency semantic-release to v21.0.7 ([abe8a91](abe8a91))
* **deps:** update dependency semantic-release to v21.0.8 ([9b478c5](9b478c5))
* **deps:** update dependency semantic-release to v21.0.9 ([d9b8bfa](d9b8bfa))
* **deps:** update dependency semantic-release to v21.1.1 ([9d3373d](9d3373d))
* **deps:** update yarn to v3.5.1 ([e938279](e938279))
* **deps:** update Yarn to v3.6.0 ([08846ca](08846ca))
* **deps:** update Yarn to v3.6.1 ([7f99cf6](7f99cf6))
* **deps:** update Yarn to v3.6.2 ([34edbda](34edbda))
* **deps:** update Yarn to v3.6.3 ([7e5fa97](7e5fa97))
* widen `engines` to support Node >= 18 ([#33](#33)) ([8eba867](8eba867))
### Build System
* **dependabot:** disable by removing configuration ([2e9f064](2e9f064))
* **deps-dev:** bump @semantic-release/git from 10.0.0 to 10.0.1 ([#44](#44)) ([111f446](111f446))
* **deps-dev:** bump @semantic-release/git from 9.0.0 to 9.0.1 ([c869ccd](c869ccd))
* **deps-dev:** bump nock from 13.0.10 to 13.0.11 ([46d73a3](46d73a3))
* **deps-dev:** bump nock from 13.0.11 to 13.1.0 ([28128fd](28128fd))
* **deps-dev:** bump nock from 13.0.5 to 13.0.6 ([#12](#12)) ([cb951dd](cb951dd))
* **deps-dev:** bump nock from 13.0.6 to 13.0.7 ([7720878](7720878))
* **deps-dev:** bump nock from 13.0.7 to 13.0.8 ([cf76bda](cf76bda))
* **deps-dev:** bump nock from 13.0.8 to 13.0.9 ([3da6f99](3da6f99))
* **deps-dev:** bump nock from 13.0.9 to 13.0.10 ([d869a36](d869a36))
* **deps-dev:** bump nock from 13.1.0 to 13.1.1 ([5df5b1c](5df5b1c))
* **deps-dev:** bump nock from 13.1.1 to 13.1.2 ([0946c39](0946c39))
* **deps-dev:** bump nock from 13.1.2 to 13.1.3 ([fc63093](fc63093))
* **deps-dev:** bump nock from 13.1.3 to 13.1.4 ([fa892a2](fa892a2))
* **deps-dev:** bump nock from 13.1.4 to 13.2.0 ([#45](#45)) ([89940be](89940be))
* **deps-dev:** bump nock from 13.2.0 to 13.2.1 ([d34aa3a](d34aa3a))
* **deps-dev:** bump nock from 13.2.1 to 13.2.2 ([c171f30](c171f30))
* **deps-dev:** bump nock from 13.2.2 to 13.2.3 ([edecad9](edecad9))
* **deps-dev:** bump nock from 13.2.3 to 13.2.4 ([44691de](44691de))
* **deps-dev:** bump nock from 13.2.4 to 13.2.6 ([9e0c0bf](9e0c0bf))
* **deps-dev:** bump nock from 13.2.6 to 13.2.7 ([162094a](162094a))
* **deps-dev:** bump nock from 13.2.7 to 13.2.8 ([862645d](862645d))
* **deps-dev:** bump nock from 13.2.8 to 13.2.9 ([9b9ef3d](9b9ef3d))
* **deps-dev:** bump semantic-release and @semantic-release/git ([#41](#41)) ([cf4d327](cf4d327))
* **deps-dev:** bump semantic-release from 17.3.0 to 17.3.7 ([#14](#14)) ([6e0ec63](6e0ec63))
* **deps-dev:** bump semantic-release from 17.3.7 to 17.3.8 ([cd83eec](cd83eec))
* **deps-dev:** bump semantic-release from 17.3.8 to 17.3.9 ([32b1770](32b1770))
* **deps-dev:** bump semantic-release from 17.3.9 to 17.4.0 ([ae5e275](ae5e275))
* **deps-dev:** bump semantic-release from 17.4.0 to 17.4.1 ([ebe49b9](ebe49b9))
* **deps-dev:** bump semantic-release from 17.4.1 to 17.4.2 ([6116ac8](6116ac8))
* **deps-dev:** bump semantic-release from 17.4.2 to 17.4.3 ([cda60ce](cda60ce))
* **deps-dev:** bump semantic-release from 17.4.3 to 17.4.4 ([fca0e87](fca0e87))
* **deps-dev:** bump semantic-release from 17.4.4 to 17.4.5 ([8f9050e](8f9050e))
* **deps-dev:** bump semantic-release from 17.4.5 to 17.4.6 ([#36](#36)) ([2008c45](2008c45))
* **deps-dev:** bump semantic-release from 17.4.6 to 17.4.7 ([fedffe8](fedffe8))
* **deps-dev:** bump semantic-release from 18.0.0 to 18.0.1 ([#47](#47)) ([8e36048](8e36048))
* **deps-dev:** bump semantic-release from 18.0.1 to 19.0.2 ([8714b5d](8714b5d))
* **deps-dev:** bump semantic-release from 19.0.2 to 19.0.3 ([e906af5](e906af5))
* **deps-dev:** bump semantic-release from 19.0.3 to 19.0.5 ([532c61b](532c61b))
* **deps-dev:** bump uvu from 0.5.1 to 0.5.2 ([5335b85](5335b85))
* **deps-dev:** bump uvu from 0.5.2 to 0.5.3 ([1c987ea](1c987ea))
* **deps-dev:** bump uvu from 0.5.3 to 0.5.4 ([4976569](4976569))
* **deps-dev:** bump uvu from 0.5.4 to 0.5.6 ([067fb9a](067fb9a))
* **deps:** bump probot from 11.0.0 to 11.0.5 ([d54abbf](d54abbf))
* **deps:** lock file maintenance ([953baf9](953baf9))
* **deps:** lock file maintenance ([ef741e2](ef741e2))
* **deps:** lock file maintenance ([d155b7b](d155b7b))
* **deps:** lock file maintenance ([9c081f6](9c081f6))
* **deps:** lock file maintenance ([40bcbbe](40bcbbe))
* **deps:** lock file maintenance ([a429b93](a429b93))
* **deps:** lock file maintenance ([a01ac39](a01ac39))
* **deps:** lock file maintenance ([41a5154](41a5154))
* **deps:** lock file maintenance ([76a76c7](76a76c7))
* **deps:** lock file maintenance ([bd264fe](bd264fe))
* **deps:** lock file maintenance ([c5ae96b](c5ae96b))
* **deps:** lock file maintenance ([21ac1ef](21ac1ef))
* **deps:** lock file maintenance ([7200b35](7200b35))
* **deps:** lock file maintenance ([b8ed369](b8ed369))
* **deps:** lock file maintenance ([9067974](9067974))
* **gitigoner:** dist ([023527b](023527b))
* **inception.yml:** set node-version to 16 ([a66fa25](a66fa25))
* **package:** build script ([5a92475](5a92475))
* **package:** lock file ([e09798c](e09798c))
* **package:** simplify repository fields ([8316610](8316610))
* **release:** compiled action for 1.0.0 ([ed4fcf8](ed4fcf8))
* **release:** compiled action for 1.1.0 ([73ba8af](73ba8af))
* **release:** compiled action for 1.1.1 ([388a96b](388a96b))
* **release:** compiled action for 1.2.0 ([51f773b](51f773b))
* **release:** compiled action for 1.2.2 ([c2cd40c](c2cd40c))
* **release:** compiled action for 1.2.3 ([17610bb](17610bb))
* remove renovate setup from package.json ([a2852ab](a2852ab))
* renovate setup ([c20a3d0](c20a3d0))
* renovate setup ([f82b4e2](f82b4e2))
* renovate setup ([dc67ecd](dc67ecd))
* **semantic-release:** configure default branch ([200be9c](200be9c))
* **test.yml:** set node-version to 16 ([c7c3aa0](c7c3aa0))
### Continuous Integration
* inception steps fix ([480ff80](480ff80))
* **release:** use node 16 ([cc24c77](cc24c77))
* **workflow:** add 'npm' cache for actions/setup-node in .github/workflows ([#33](#33)) ([dd7d0df](dd7d0df))
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcusrbrownmarcusrbrownmarcusrbrown approved these changes

Assignees

No one assigned

Labels

securitySecurity

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@marcusrbrown