Security issue in depndencies

[jaceksocha]

Hi!

I've found security issue reported in one of dependencies "cdbattags/lua-resty-jwt" (cdbattags/lua-resty-jwt#61)

Just to make sure: is "zmartzone/lua-resty-openidc" is also affected ?

Greetings

[bodewig]

The report doesn't say explicitly what it takes to exploit the vulnerability. Looking at the PR it seems lua-resty-jwt can be tricked to validate JWT using JWE validation skipping the signature verification, but I'm not really familiar with the library's internals and basically take some educated guesses.

Right now lua-resty-openidc doesn't support unsigned JWEs (see #440 ) and signatures are always checked, so if my understanding of the issue is correct, the attack wouldn't work here. But please take this with a very big grain of salt.

[nemmerich]

From a quick look into this library it seems to be affected by this issue. It is correct that the underlying issue is caused by a way to get JWTs to be validated as JWEs skipping the signature check, but this is internal to the lua-resty-jwt library. The caller does not need to support JWEs to be affected.

[bodewig]

thank you for having a second look

[ironsidevsquincy]

As a user of this library (specifically the bearer_jwt_verify function), can confirm this is affected by the issue in lua-resty-jwt - can supply a token with an enc value of "A256GCM", and the token's signtature is not validated.
From that issue, looks like https://luarocks.org/modules/membphis/api7-lua-resty-jwt has the path, so might be worth updating to use that dependency