{ "cveId": "CVE-2024-51744", "url": "https://patchblox.com/security/cve/CVE-2024-51744", "summary": "CVE-2024-51744 is fixed in 14 products on 1 platform, first by DEBIAN-CVE-2024-51744, released November 4, 2024. It is not reported as exploited. Patch Radar priority: Routine.", "title": "golang-github-golang-jwt-jwt: golang-jwt is a Go implementation of JSON Web Tokens", "description": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in \u0060ParseWithClaims\u0060 can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by \u0060ParseWithClaims\u0060 return both error codes. If users only check for the \u0060jwt.ErrTokenExpired \u0060 using \u0060error.Is\u0060, they will ignore the embedded \u0060jwt.ErrTokenSignatureInvalid\u0060 and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the \u0060v5\u0060 branch to the \u0060v4\u0060 branch. In this logic, the \u0060ParseWithClaims\u0060 function will immediately return in \u0022dangerous\u0022 situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\u0022dangerous\u0022 ones first), so that you are not running in the case detailed above.", "published": "2024-11-04T22:15:03Z", "severity": "low", "cvss": 3.1, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "epss": 0.00585, "epssPercentile": 0.48216, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "coredns", "release": "opensuse-leap 15.6", "fixedVersion": "1.12.1-bp156.4.6.5", "fix": "OPENSUSE-SU-2025:0131-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-0131-1", "released": "2025-04-19T22:01:42Z" }, { "platform": "linux", "product": "coredns", "release": "opensuse-leap 16.0", "fixedVersion": "1.14.0-bp160.1.1", "fix": "OPENSUSE-SU-2026:20099-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20099-1", "released": "2026-01-24T09:09:32Z" }, { "platform": "linux", "product": "cosign", "release": "opensuse-leap 15.6", "fixedVersion": "2.5.0-150400.3.27.1", "fix": "SUSE-SU-2025:1333-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-1333-1", "released": "2025-04-17T01:38:19Z" }, { "platform": "linux", "product": "cosign", "release": "sles 15.6", "fixedVersion": "2.5.0-150400.3.27.1", "fix": "SUSE-SU-2025:1333-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-1333-1", "released": "2025-04-17T01:38:19Z" }, { "platform": "linux", "product": "docker", "release": "amzn 2023", "fixedVersion": "25.0.8-1.amzn2023.0.1", "fix": "ALAS2023-2025-852", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-852", "released": "2025-02-12T22:57:00Z" }, { "platform": "linux", "product": "docker-debuginfo", "release": "amzn 2023", "fixedVersion": "25.0.8-1.amzn2023.0.1", "fix": "ALAS2023-2025-852", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-852", "released": "2025-02-12T22:57:00Z" }, { "platform": "linux", "product": "docker-debugsource", "release": "amzn 2023", "fixedVersion": "25.0.8-1.amzn2023.0.1", "fix": "ALAS2023-2025-852", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-852", "released": "2025-02-12T22:57:00Z" }, { "platform": "linux", "product": "dracut-saltboot", "release": "opensuse-leap 15.6", "fixedVersion": "0.1.1728559936.c16d4fb-150000.1.56.1", "fix": "SUSE-SU-2025:0525-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1", "released": "2025-02-14T07:18:27Z" }, { "platform": "linux", "product": "golang-github-golang-jwt-jwt", "release": "Debian 13.5 (trixie)", "fixedVersion": "5.0.0\u002Breally4.5.2-1", "fix": "DEBIAN-CVE-2024-51744", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-51744", "released": "2024-11-04T22:15:03Z" }, { "platform": "linux", "product": "golang-github-golang-jwt-jwt", "release": "Debian 14", "fixedVersion": "5.0.0\u002Breally4.5.2-1", "fix": "DEBIAN-CVE-2024-51744", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-51744", "released": "2024-11-04T22:15:03Z" }, { "platform": "linux", "product": "golang-github-prometheus-prometheus", "release": "opensuse-leap 15.6", "fixedVersion": "2.53.3-150100.4.23.1", "fix": "SUSE-SU-2025:0546-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0546-1", "released": "2025-02-14T07:24:38Z" }, { "platform": "linux", "product": "golang-github-prometheus-prometheus", "release": "sles 15.6", "fixedVersion": "2.53.3-150100.4.23.1", "fix": "SUSE-SU-2025:0546-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0546-1", "released": "2025-02-14T07:24:38Z" }, { "platform": "linux", "product": "golang-github-prometheus-promu", "release": "opensuse-leap 15.6", "fixedVersion": "0.17.0-150000.3.24.1", "fix": "SUSE-SU-2025:0525-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1", "released": "2025-02-14T07:18:27Z" }, { "platform": "linux", "product": "golang-github-prometheus-promu", "release": "sles 15.6", "fixedVersion": "0.17.0-150000.3.24.1", "fix": "SUSE-SU-2025:0525-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1", "released": "2025-02-14T07:18:27Z" }, { "platform": "linux", "product": "govulncheck-vulndb", "release": "opensuse-leap 15.6", "fixedVersion": "0.0.20241112T145010-150000.1.17.1", "fix": "SUSE-SU-2024:4042-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4042-1", "released": "2024-11-22T10:44:11Z" }, { "platform": "linux", "product": "govulncheck-vulndb", "release": "sles 15.6", "fixedVersion": "0.0.20241112T145010-150000.1.17.1", "fix": "SUSE-SU-2024:4042-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4042-1", "released": "2024-11-22T10:44:11Z" }, { "platform": "linux", "product": "runfinch-finch", "release": "amzn 2023", "fixedVersion": "1.6.0-1.amzn2023.0.1", "fix": "ALAS2023-2025-834", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-834", "released": "2025-01-30T03:53:00Z" }, { "platform": "linux", "product": "spacecmd", "release": "opensuse-leap 15.6", "fixedVersion": "5.0.11-150000.3.130.1", "fix": "SUSE-SU-2025:0525-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1", "released": "2025-02-14T07:18:27Z" }, { "platform": "linux", "product": "supportutils-plugin-salt", "release": "opensuse-leap 15.6", "fixedVersion": "1.2.3-150000.3.16.1", "fix": "SUSE-SU-2025:0525-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1", "released": "2025-02-14T07:18:27Z" }, { "platform": "linux", "product": "supportutils-plugin-salt", "release": "sles 15.6", "fixedVersion": "1.2.3-150000.3.16.1", "fix": "SUSE-SU-2025:0525-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1", "released": "2025-02-14T07:18:27Z" }, { "platform": "linux", "product": "supportutils-plugin-susemanager-client", "release": "opensuse-leap 15.6", "fixedVersion": "5.0.4-150000.3.27.1", "fix": "SUSE-SU-2025:0525-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1", "released": "2025-02-14T07:18:27Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }