如何绕过dgrijalva/jwt go中的cve-2020-26160漏洞

go jwt jwt-go

由于存在一个高级漏洞，Gitlab管道中无法传递容器安全状态。此漏洞为jwt-go，安装的版本为v3.2.0+incompatible。错误标题如下：jwt-go: access restriction bypass vulnerability–>avd.aquasec.com/nvd/cve-2020-26160。相关回购协议的Go版本为1.16.3。如何修复此漏洞？

CVE-2020-26160漏洞是由于dgrijalva/jwt-go错误地将JWTaud字段建模为string，而基于JWT规范，它应该是字符串的一部分。

在一般情况下，“aud”值是case-sensitive字符串的数组

你自己不能绕过它，因为它是库中的一个bug：https://github.com/dgrijalva/jwt-go/issues/428

切换到官方社区分支golang-jwt/jwt，其v3.2.1修复了漏洞：https://github.com/golang-jwt/jwt/releases/tag/v3.2.1

导入路径更改：有关更新代码的提示，请参见MIGRATION_GUIDE.md，将导入路径从github.com/dgrijalva/jwt-go更改为github.com/golang-jwt/jwt
修复了VerifyAudience（#12）中字符串和[]字符串之间的类型混淆问题。这修复了CVE-2020-26160

原文连接: https://www.5axxw.com/questions/content/o849sj

文档地址: https://docs.gofiber.io/

helloworld

package mainimport "github.com/gofiber/fiber/v2"func main() {app := fiber.New()app.Get("/", func(c *fiber.Ctx) error {return c.SendString("Hello, World!")})app.Listen(":3000")
}

其他案例

fiber-demo

原文连接: https://victorfengming.gitee.io/golang/fiber/jwt-bug/

fiber报错 (type *big.Int has no field or method FillBytes)相关推荐

k8s使用glusterfs存储报错type 'features/utime'
k8s使用glusterfs存储报错type 'features/utime' is not valid or not found on this machine pods报错如下 Events:Ty ...
python2 中使用pip2 install package_name的时候报错：AttributeError: ‘int‘ object has no attribute ‘endswith‘
1 错误说明 1.在python2的环境下使用pip2 install安装库包的时候报错:AttributeError: 'int' object has no attribute 'endswith ...
Eclipse正确配置Tomcat之后仍然报错Type Target runtime Apache Tomcat v8.0 is not defined解决方式
Eclipse正确配置Tomcat之后仍然报错Type Target runtime Apache Tomcat v8.0 is not defined解决方式虽然项目能正常运行,但是看着这个红叉叉 ...
解决报错Type interface ___ is not known to the MapperRegistry.
解决报错Type interface ___ is not known to the MapperRegistry. 最近几天因为这个问题一直出错今天终于在查看日志文件中找到原因是因为在mybat ...
# SpringCloud集成报错 An attempt was made to call a method that does not exist. The attempt was
SpringCloud集成报错 An attempt was made to call a method that does not exist. The attempt was made from ...
【错误记录】Kotlin 编译报错 ( Type mismatch: inferred type is String? but String was expected )
文章目录一.报错信息二.解决方案一.报错信息 Google Play 上架要求 Android 的编译版本和目标版本都要高于 30 才可以上传 ; 将 Android 的编译版本和目标版 ...
c++中使用index变量报错：error: ‘int index‘ redeclared as different kind of symbol
报错信息如下: /judger/run/e9f1df8da21548be9d76e7a59262ca1f/main.cpp:7:5: error: 'int index' redeclared as ...
es 创建索引报错_ES添加映射报错analyzer [ik_max_word] not found for field [title]
给索引创建映射报错 { "error":{ "root_cause":[ { "type":"mapper_parsing_exc ...
报错：Unsatisfied dependency expressed through field 'xxxService';
报错片段: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with nam ...

fiber报错 (type *big.Int has no field or method FillBytes)

如何绕过dgrijalva/jwt go中的cve-2020-26160漏洞

helloworld

其他案例

fiber报错 (type *big.Int has no field or method FillBytes)相关推荐

最新文章

热门文章