CVE-2025-22149 – github.com/micahparks/jwkset

Package

Manager: go
Name: github.com/micahparks/jwkset
Vulnerable Version: >=0.5.0 <0.6.0

Severity

Level: Low

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

EPSS: 0.00216 pctl0.4418

Details

JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh ### Impact The project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. Example attack scenario: 1. An attacker has stolen the private key for a key published in JWK Set. 2. The publishers of that JWK Set remove that key from the JWK Set. 3. Enough time has passed that the program using the auto-caching HTTP client found in `github.com/MicahParks/jwkset` v0.5.0-v0.5.21 has elapsed its `HTTPClientStorageOptions.RefreshInterval` duration, causing a refresh of the remote JWK Set. 4. The attacker is signing content (such as JWTs) with the stolen private key and the system has no other forms of revocation. ### Patches The affected auto-caching HTTP client was added in version `v0.5.0` and fixed in `v0.6.0`. Upgrade to `v0.6.0` or later. ### Workarounds The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the `HTTPClientStorageOptions.RefreshInterval` to zero (or not specifying the value). Upgrade to `v0.6.0` is advised. ### References Please see the tracking issue on GitHub for additional details: https://github.com/MicahParks/jwkset/issues/40

Metadata

Created: 2025-01-09T17:23:43Z
Modified: 2025-01-09T18:57:32Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-675f-rq2r-jw82/GHSA-675f-rq2r-jw82.json
CWE IDs: ["CWE-672"]
Alternative ID: GHSA-675f-rq2r-jw82
Finding: F067
Auto approve: 1