Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upGuard against PKCS1 PEM-encoded public keys #277
+61
−0
Conversation
jpadilla
added some commits
Jun 21, 2017
jpadilla
added
the
bug
label
Jun 22, 2017
jpadilla
self-assigned this
Jun 22, 2017
jpadilla
requested a review
from
mark-adams
Jun 22, 2017
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment
Hide comment
coveralls
commented
Jun 22, 2017
•
edited
Edited 1 time
-
coveralls
edited Jun 22, 2017 (most recent)
-
coveralls
created
Jun 22, 2017
edited
Edited 1 time
-
Jun 22, 2017 (most recent) -
Jun 22, 2017
jpadilla
merged commit eb3f581
into
master
Jun 22, 2017
5 checks passed
continuous-integration/appveyor/branch
AppVeyor build succeeded
Details
continuous-integration/appveyor/pr
AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr
The Travis CI build passed
Details
continuous-integration/travis-ci/push
The Travis CI build passed
Details
coverage/coveralls
Coverage remained the same at 100.0%
Details
jpadilla
deleted the
fix-vuln
branch
Jun 22, 2017
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment
Hide comment
paragonie-scott
Sep 1, 2017
Should this also block ECDSA public keys? Or are those outright not supported?
paragonie-scott
commented
Sep 1, 2017
|
Should this also block ECDSA public keys? Or are those outright not supported? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
jpadilla commentedJun 22, 2017
Previous to this we were not correctly accounting for all PEM encoded public keys, like the PKCS1 PEM encoded format which is prefaced by
-----BEGIN RSA PUBLIC KEY-----. This fix prevents symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.We've also added a deprecation warning when using
decode()and not specifying thealgorithmsparam. This will be required in a future release.