CVE-2024-51744: Github.com/golang jwt/jwt/v4 Bad Documentation Of Error Handling Vulnerability

Q: What is CVE-2024-51744?

CVE-2024-51744 is a security vulnerability in Github.com/golang jwt/jwt/v4 involving Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations under CWE-755: Improper Handling of Exceptional Conditions.

Q: Which Github.com/golang jwt/jwt/v4 versions are affected?

Affected versions include releases prior to 4.5.1 across affected packages: github.com/golang-jwt/jwt/v4.

Q: What version fixes CVE-2024-51744?

Upgrading to 4.5.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is github.com/golang-jwt/jwt/v4 affected?

Yes, github.com/golang-jwt/jwt/v4 is affected in releases prior to 4.5.1. Upgrade your dependency to 4.5.1 or later.

Q: What is the CVSS score of CVE-2024-51744?

CVE-2024-51744 has a CVSS v3.1 base score of 3.1 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.

Q: What CWE is associated with CVE-2024-51744?

CVE-2024-51744 is classified under CWE-755: Improper Handling of Exceptional Conditions (The product does not handle or incorrectly handles an exceptional condition.).

Q: How can I check Go dependencies for CVE-2024-51744?

Run the dependency tree command: 'inspect dependencies for github.com/golang-jwt/jwt/v4'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

LOW

Advisory Identifier: GHSA-29wx-vh33-7x7r

CVSS 3.1

CWE-755 CWE-347

Published 2024-11-04

Advisory Summary

CVE-2024-51744 is a LOW (CVSS 3.1) bad documentation of error handling vulnerability (CWE-755: Improper Handling of Exceptional Conditions) affecting Github.com/golang jwt/jwt/v4 libraries in the Go ecosystem. The issue involves bad documentation of error handling in parsewithclaims can lead to potentially dangerous situations. Remediation is available by upgrading affected packages to version 4.5.1.

CVE-2024-51744 at a Glance

CVE Identifier CVE-2024-51744

GHSA Identifier GHSA-29wx-vh33-7x7r

Severity LOW

CVSS v3.1 Base Score 3.1

CWE Classification CWE-755: Improper Handling of Exceptional Conditions

Affected Product Github.com/golang jwt/jwt/v4

Package Ecosystem Go

Published Date 2024-11-04

Last Updated 2024-11-12

Security Impact

CVSS: 3.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)

Attack Complexity High (AC:H)

Privileges Required None (PR:N)

User Interaction Required (UI:R)

Scope Unchanged (S:U)

Confidentiality Low (C:L)

Integrity None (I:N)

Availability None (A:N)

How to Fix CVE-2024-51744

To remediate this vulnerability, upgrade all affected Github.com/golang jwt/jwt/v4 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/golang-jwt/jwt/v4 fixed: 4.5.1

Upgrade github.com/golang-jwt/jwt/v4 to 4.5.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for github.com/golang-jwt/jwt/v4

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-51744, inspect your project dependencies for Github.com/golang jwt/jwt/v4:

inspect dependencies for github.com/golang-jwt/jwt/v4

Analyze the terminal output to locate any version of Github.com/golang jwt/jwt/v4 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.5.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-755: Improper Handling of Exceptional Conditions, where the product does not handle or incorrectly handles an exceptional condition. In Github.com/golang jwt/jwt/v4, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. ### Fix We have back-ported the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. ### Workaround We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above. ```Go token, err := /* jwt.Parse or similar */ if token.Valid { fmt.Println("You look nice today") } else if errors.Is(err, jwt.ErrTokenMalformed) { fmt.Println("That's not even a token") } else if errors.Is(err, jwt.ErrTokenUnverifiable) { fmt.Println("We could not verify this token") } else if errors.Is(err, jwt.ErrTokenSignatureInvalid) { fmt.Println("This token has an invalid signature") } else if errors.Is(err, jwt.ErrTokenExpired) || errors.Is(err, jwt.ErrTokenNotValidYet) { // Token is either expired or not active yet fmt.Println("Timing is everything") } else { fmt.Println("Couldn't handle this token:", err) } ```

CVE-2024-51744 Affected Github.com/golang jwt/jwt/v4 Versions

1 component(s)

Fixed Versions:

4.5.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
github.com/golang-jwt/jwt/v4 golang/github.com/golang-jwt/jwt/v4	Go	< 4.5.1	4.5.1

References

GitHub Advisory / Wiki ADVISORY

https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r

NVD — CVE-2024-51744 NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-51744

Security Fix Commit FIX COMMIT

https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c

Github.com/golang jwt/jwt/v4 Source Repository REPOSITORY

https://github.com/golang-jwt/jwt

Frequently Asked Questions

What is CVE-2024-51744?

CVE-2024-51744 is a security vulnerability in Github.com/golang jwt/jwt/v4 involving Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations under CWE-755: Improper Handling of Exceptional Conditions.

Which Github.com/golang jwt/jwt/v4 versions are affected?

Affected versions include releases prior to 4.5.1 across affected packages: github.com/golang-jwt/jwt/v4.

What version fixes CVE-2024-51744?

Upgrading to 4.5.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is github.com/golang-jwt/jwt/v4 affected?

Yes, github.com/golang-jwt/jwt/v4 is affected in releases prior to 4.5.1. Upgrade your dependency to 4.5.1 or later.

What is the CVSS score of CVE-2024-51744?

CVE-2024-51744 has a CVSS v3.1 base score of 3.1 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.

What CWE is associated with CVE-2024-51744?

CVE-2024-51744 is classified under CWE-755: Improper Handling of Exceptional Conditions (The product does not handle or incorrectly handles an exceptional condition.).

How can I check Go dependencies for CVE-2024-51744?

Run the dependency tree command: 'inspect dependencies for github.com/golang-jwt/jwt/v4'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-29wx-vh33-7x7r",
  "modified" : "2024-11-12T21:32:34Z",
  "published" : "2024-11-04T23:22:41Z",
  "aliases" : [ "CVE-2024-51744" ],
  "summary" : "Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations",
  "details" : "### Summary\n\nUnclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens.\n\n### Fix\n\nWe have back-ported the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release.\n\n### Workaround \n\nWe are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.\n\n```Go\ntoken, err := /* jwt.Parse or similar */\nif token.Valid {\n\tfmt.Println(\"You look nice today\")\n} else if errors.Is(err, jwt.ErrTokenMalformed) {\n\tfmt.Println(\"That's not even a token\")\n} else if errors.Is(err, jwt.ErrTokenUnverifiable) {\n\tfmt.Println(\"We could not verify this token\")\n} else if errors.Is(err, jwt.ErrTokenSignatureInvalid) {\n\tfmt.Println(\"This token has an invalid signature\")\n} else if errors.Is(err, jwt.ErrTokenExpired) || errors.Is(err, jwt.ErrTokenNotValidYet) {\n\t// Token is either expired or not active yet\n\tfmt.Println(\"Timing is everything\")\n} else {\n\tfmt.Println(\"Couldn't handle this token:\", err)\n}\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/golang-jwt/jwt/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-51744"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/golang-jwt/jwt"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-347", "CWE-755" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-04T23:22:41Z",
    "nvd_published_at" : "2024-11-04T22:15:03Z"
  }
}

CVSS V3

3.1 LOW