Security advisory (GHSA-8cf7-32gw-wr33) clarification for symmetric algorithm types
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 30/100
- Issue type
- Documentation
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- documentation, security
Research direction
Start by reading advisory GHSA-8cf7-32gw-wr33 and the CVE-2022-23539 conditions described in the issue. Confirm whether symmetric algorithms such as HS256 are affected, then clarify the advisory so its affected combinations and algorithm requirements are unambiguous.
Written by the indexing model from the issue text.
Description
The recent advisory https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33 makes it appear that only asymmetric algorithms are secure in v.8.5.1 in the sense that if one's using symmetric algorithms like HS256 you are "affected" by the vulnerability since HS256 is not listed in the tables.
| Key type | algorithm |
|---|---|
| ec | ES256, ES384, ES512 |
| rsa | RS256, RS384, RS512, PS256, PS384, PS512 |
| rsa-pss | PS256, PS384, PS512 |
| alg | Curve |
|---|---|
| ES256 | prime256v1 |
| ES384 | secp384r1 |
| ES512 | secp521r1 |
But for CVE-2022-23539, isn't it true that you are affected only if BOTH of these conditions are true?
- Using asymmetric algorithm <--- missing?
- Using combinations other than what's listed...
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
antfu-collective/icones#398 ·
-
ECmail.com Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
wesbos/burner-email-providers#554 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
radiantearth/stac-browser#1023 ·
-
HMR stops working Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
components-web-app/docs#92 ·