CVE-2024-51744: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt

Published Nov 4, 2024
·
Updated

Summary

Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

Fix

We have back-ported the error handling logic from the v5 branch to the v4 branch. In this logic, the ParseWithClaims function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release.

Workaround

We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above.

Go token, err := / jwt.Parse or similar / if token.Valid { fmt.Println("You look nice today") } else if errors.Is(err, jwt.ErrTokenMalformed) { fmt.Println("That's not even a token") } else if errors.Is(err, jwt.ErrTokenUnverifiable) { fmt.Println("We could not verify this token") } else if errors.Is(err, jwt.ErrTokenSignatureInvalid) { fmt.Println("This token has an invalid signature") } else if errors.Is(err, jwt.ErrTokenExpired) || errors.Is(err, jwt.ErrTokenNotValidYet) { // Token is either expired or not active yet fmt.Println("Timing is everything") } else { fmt.Println("Couldn't handle this token:", err) }

Other sources

Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt

— Microsoft

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the v5 branch to the v4 branch. In this logic, the ParseWithClaims function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above.

— NVD

Affected Software

53 affected componentsFixes available
go/github.com/golang-jwt/jwt/v4<4.5.1
4.5.1
IBM Concert Software<=1.0.0-2.1.0
Microsoft cbl2 telegraf 1.29.4-15<1.29.4-14
1.29.4-14
Microsoft cbl2 dcos-cli 1.2.0-21<1.2.0-21
1.2.0-21
Microsoft cbl2 application-gateway-kubernetes-ingress 1.4.0-25<1.4.0-25
1.4.0-25
Microsoft cbl2 etcd 3.5.21-1<3.5.21-1
3.5.21-1
Microsoft cbl2 prometheus 2.37.9-4<2.37.9-4
2.37.9-4
Microsoft cbl2 rook 1.6.2-26<1.6.2-26
1.6.2-26
Microsoft cbl2 cert-manager 1.11.2-22<1.11.2-22
1.11.2-22
Microsoft cbl2 jx 3.2.236-21<3.2.236-21
3.2.236-21
Microsoft cbl2 azcopy 10.25.1-5<10.25.1-4
10.25.1-4
Microsoft azl3 kubernetes 1.30.10-7<1.30.10-5
1.30.10-5
Microsoft cbl2 cf-cli 8.4.0-24<8.4.0-24
8.4.0-24
Microsoft azl3 packer 1.9.5-9<1.9.5-8
1.9.5-8
Microsoft azl3 etcd 3.5.12-2<3.5.18-1
3.5.18-1
Microsoft azl3 keda 2.14.1-7<2.14.1-6
2.14.1-6
Microsoft cbl2 kubevirt 0.59.0-28<0.59.0-27
0.59.0-27
Microsoft azl3 application-gateway-kubernetes-ingress 1.7.2-3<1.7.7-1
1.7.7-1
Microsoft cbl2 packer 1.9.5-12<1.9.5-11
1.9.5-11
Microsoft cbl2 kubernetes 1.28.4-17<1.28.4-17
1.28.4-17
Microsoft cbl2 etcd 3.5.12-6<3.5.21-1
3.5.21-1
Microsoft cbl2 influxdb 2.6.1-22<2.6.1-22
2.6.1-22
Microsoft cbl2 coredns 1.11.1-18<1.11.1-18
1.11.1-18
Microsoft azl3 influxdb 2.7.5-5<2.7.5-3
2.7.5-3
Microsoft azl3 jx 3.10.116-2<3.10.182-1
3.10.182-1
Microsoft azl3 moby-engine 25.0.3-13<25.0.3-13
25.0.3-13
Microsoft azl3 coredns 1.11.1-4<1.11.4-1
1.11.4-1
Microsoft azl3 telegraf 1.31.0-10<1.31.0-6
1.31.0-6
Microsoft cbl2 moby-engine 24.0.9-17<24.0.9-17
24.0.9-17
Microsoft cbl2 kube-vip-cloud-provider 0.0.2-22<0.0.2-22
0.0.2-22
Microsoft azl3 flannel 0.24.2-14<0.24.2-13
0.24.2-13
Microsoft cbl2 keda 2.4.0-29<2.4.0-29
2.4.0-29
Microsoft azl3 cert-manager 1.12.15-1<1.12.15-1
1.12.15-1
Microsoft azl3 cert-manager 1.12.13-2<1.12.15-1
1.12.15-1
Microsoft azl3 packer 1.9.5-8<1.9.5-8
1.9.5-8
Microsoft azl3 coredns 1.11.4-1<1.11.4-1
1.11.4-1
Microsoft azl3 flannel 0.24.2-13<0.24.2-13
0.24.2-13
Microsoft azl3 azcopy 10.25.1-4<10.25.1-4
10.25.1-4
Microsoft azl3 influxdb 2.7.5-3<2.7.5-3
2.7.5-3
Microsoft azl3 application-gateway-kubernetes-ingress 1.7.7-1<1.7.7-1
1.7.7-1
Microsoft azl3 kubernetes 1.30.10-5<1.30.10-5
1.30.10-5
Microsoft azl3 keda 2.14.1-6<2.14.1-6
2.14.1-6
Microsoft azl3 dcos-cli 1.2.0-18<1.2.0-18
1.2.0-18
Microsoft azl3 etcd 3.5.18-1<3.5.18-1
3.5.18-1
Microsoft azl3 jx 3.10.182-1<3.10.182-1
3.10.182-1
Microsoft azl3 telegraf 1.31.0-6<1.31.0-6
1.31.0-6
Microsoft cbl2 telegraf 1.29.4-14<1.29.4-14
1.29.4-14
Microsoft cbl2 kubevirt 0.59.0-27<0.59.0-27
0.59.0-27
Microsoft azl3 prometheus 2.45.4-12<2.45.4-12
2.45.4-12
Microsoft cbl2 packer 1.9.5-11<1.9.5-11
1.9.5-11
Microsoft cbl2 azcopy 10.25.1-4<10.25.1-4
10.25.1-4
Microsoft cbl2 blobfuse2 2.1.2-8
Microsoft cbl2 terraform 1.3.2-25

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/github.com/golang-jwt/jwt/v4 to a version that resolves this vulnerability.

    Fixed in 4.5.1
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.29.4-14
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.2.0-21
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.5.21-1
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.4.0-25
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.37.9-4
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.11.2-22
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.2.236-21
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.6.2-26
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.25.1-4
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.30.10-5
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 8.4.0-24
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.14.1-6
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.9.5-8
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.59.0-27
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.5.18-1
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.28.4-17
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.7.7-1
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.9.5-11
  20. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.6.1-22
  21. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.7.5-3
  22. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.11.1-18
  23. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 25.0.3-13
  24. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.10.182-1
  25. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.31.0-6
  26. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.11.4-1
  27. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 24.0.9-17
  28. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.0.2-22
  29. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.24.2-13
  30. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.4.0-29
  31. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.12.15-1
  32. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.2.0-18
  33. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.45.4-12
  34. Upgrade

    Upgrade golang-jwt to a version that resolves this vulnerability.

    Fixed in 4.5.1
  35. Configuration

    If you cannot update to 4.5.1, ensure you properly check all returned errors from ParseWithClaims by handling “dangerous” situations first (e.g., invalid signature via jwt.ErrTokenSignatureInvalid / jwt.ErrTokenUnverifiable), so you do not ignore embedded errors when a token is both expired and invalid.

    ParseWithClaims error handling error checking order = dangerous errors first (e.g., jwt.ErrTokenSignatureInvalid before jwt.ErrTokenExpired / jwt.ErrTokenNotValidYet)

Event History

Nov 4, 2024
CVE Published
via MITRE·09:47 PM
Data Sourced
via MITRE·09:47 PM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·10:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·11:22 PM
Jan 30, 2025
Data Sourced
via Microsoft·12:00 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·12:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
Description
Updated
via Microsoft·08:00 AM
SeverityAffected Software
Updated
via Microsoft·08:00 AM
Affected Software
Jan 14, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-51744?

CVE-2024-51744 has a moderate severity rating due to unclear error handling in token parsing.

2

How do I fix CVE-2024-51744?

To fix CVE-2024-51744, ensure that you update the jwt package to version 4.5.1 or later.

3

What are the potential risks of CVE-2024-51744?

The risks of CVE-2024-51744 include improper handling of expired and invalid tokens, which can lead to security flaws in authentication.

4

Which software versions are affected by CVE-2024-51744?

CVE-2024-51744 affects versions of the github.com/golang-jwt/jwt/v4 package prior to 4.5.1.

5

What is 'ParseWithClaims' in relation to CVE-2024-51744?

'ParseWithClaims' is a function in the golang-jwt library that may not handle error conditions correctly, leading to potential security risks.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203