Reporting a vulnerability

[TomTervoort]

Hi,

I discovered a vulnerability in JWX that I would like to report. However, I can't seem to find an appropriate (private) channel to contact the maintainer for responsible disclosure.

@sop How would you like to receive this report?

[sop]

Hi!

I've added email address to my profile.

[TomTervoort]

Thanks! I'll reach out to you via mail.

[kenjis]

Hi, this vulnerability was fixed or not?

[sop]

Hi, this vulnerability was fixed or not?

Hi! It was fixed in master branch but i never got to push a release. I've just released a new tag, which is a major release by semantic versioning, so please update your dependencies if necessary. Technically this is a breaking change if someone was relying on vulnerable algorithms in question.