Incorrect Implementation of Authentication Algorithm Affecting github.com/hashicorp/vault-plugin-auth-jwt package, versions <0.20.3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMHASHICORPVAULTPLUGINAUTHJWT-7251358
- published 13 Jun 2024
- disclosed 12 Jun 2024
- credit Kacper Stysiński, Alex Scheel
Introduced: 12 Jun 2024
CVE-2024-5798 Open this link in a new tabHow to fix?
Upgrade github.com/hashicorp/vault-plugin-auth-jwt to version 0.20.3 or higher.
Overview
github.com/hashicorp/vault-plugin-auth-jwt is a standalone backend plugin that allows for JWTs (including OIDC tokens) to authenticate with Vault.
Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when validating an audience claim in the JWT auth method. An attacker can authenticate with an invalid login by sending an audience claim comprising multiple strings. This implementation was found to be inconsistent with RFC 7519.