hyperscale-stack / security / 39581499514

98%

Build Type

push

github

Committed by web-flow

Commit Message

fix(jwt,oidc)!: refuse key-bearing JOSE headers, upgrade go-jose to v4.1.6

Close the only High finding of the security audit of 2026-10-21: an
unauthenticated JWS could make go-jose (<= v4.1.5) validate an
attacker-supplied RSA private key from its `jwk` header before any check,
costing minutes of CPU per 16 KiB token (GHSA-mgcc-cww5-fp2q).

- jwtsec refuses the key-bearing JOSE header members jwk, x5c, jku and
  x5u before go-jose parses the header (Verifier, VerifySignature,
  BearerVerifier, the OpenID Provider's id_token_hint) — a local policy
  (RFC 8725 §3.10); tokens carrying jku (Cloud Foundry UAA, SAP XSUAA)
  are refused, as documented in MIGRATION.md.
- oidc/client decodes the ID Token JOSE header strictly first: at most
  4 KiB decoded, strict JSON, the same four members refused, all as
  ErrIDTokenMalformed (also closes I-15).
- go-jose is v4.1.6 in every module. RSA keys are bounded to 2048-4096
  bits by our own constant, independent of jose.MaxRSAModulusBits: JWK
  Set keys, signing keys at construction, MarshalJWKS and the provider's
  published keys (go-jose relying parties reject a whole JWK Set holding
  a larger key).
- The advisory token now costs 79 allocations instead of about 41,000.

Breaking changes and migration steps: MIGRATION.md.

Audit: F-01, F-02, I-15.

Coverage Stats

42 of 42 new or added lines in 4 files covered. (100.0%)

1 existing line in 1 file now uncovered.

13896 of 14109 relevant lines covered (98.49%)

4976.76 hits per line