JWT-go package is vulnerable

[ManavIBM]

Playground link - N/A

The package github.com/dgrijalva/jwt-go introduces a vulnerabiltiy to the postgres driver for gorm

Details of vulnerability:

github.com/dgrijalva/jwt-go is a go implementation of JSON Web Tokens.

Affected versions of this package are vulnerable to Access Restriction Bypass if m["aud"] happens to be []string{}, as allowed by the spec, the type assertion fails and the value of aud is "". This can cause audience verification to succeed even if the audiences being passed are incorrect if required is set to false.

Remediation
Upgrade github.com/dgrijalva/jwt-go to version 4.0.0-preview1 or higher.

[jinzhu]

Hi @ManavIBM

We don't rely on the package, thank you for your report.