Skip to content

Upgrade com.nimbusds:nimbus-jose-jwt dependency #7720

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
elefeint opened this issue Dec 11, 2019 · 4 comments
Closed

Upgrade com.nimbusds:nimbus-jose-jwt dependency #7720

elefeint opened this issue Dec 11, 2019 · 4 comments
Assignees
@jzheaux
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: dependency-upgrade A dependency upgrade
Milestone
5.3.0.M1

Comments

@elefeint
Copy link
Contributor

Summary

Upgrade com.nimbusds:nimbus-jose-jwt to version 7.9 or higher (it is currently 7.8.1, which seems to be the final bugfix version for 7.8 branch)

There is a medium severity validation security vulnerability (snyk, blog) on lower versions.
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Dec 11, 2019
@elefeint elefeint mentioned this issue Dec 11, 2019
Closed
@fhanik fhanik added this to the 5.3.0.M1 milestone Dec 12, 2019
@fhanik fhanik added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: waiting-for-feedback We need additional information before we can continue and removed status: waiting-for-triage An issue we've not yet triaged labels Dec 12, 2019
@fhanik
Copy link
Contributor

fhanik commented Dec 12, 2019

I've requested input from @jzheaux. I remember there may be some incompatibilities that need to be resolved prior to fixing this.

@jzheaux jzheaux added type: dependency-upgrade A dependency upgrade and removed status: waiting-for-feedback We need additional information before we can continue labels Dec 17, 2019
@MichaelVetter
Copy link

The security vulnerability is fixed in version 7.8.1 (see #7570) but it is helpful that you upgraded the version.

@jzheaux
Copy link
Contributor

jzheaux commented Dec 19, 2019

Correct, @MichaelVetter, because Spring Security was on 7.8.1, there's no security issue. It's always the goal to upgrade to the latest possible, though, so this was a good ticket either way.

@elefeint
Copy link
Contributor Author

Ah, so it was a false positive because CVE did not get updated. Good to know, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jzheaux jzheaux

Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: dependency-upgrade A dependency upgrade
Projects
None yet
Milestone
5.3.0.M1
Development

No branches or pull requests
5 participants
@fhanik @jzheaux @MichaelVetter @spring-projects-issues @elefeint