Skip to content
Fencer Vulns
low 3.1

CVE-2024-51744 json

Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt

published 2024-11-04 2 y ago modified 2026-09-10 1 mo ago also GHSA-29wx-vh33-7x7r , GO-2024-3250 , EUVD-2024-3178

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above.

Patch / fix

  • go github.com/golang-jwt/jwt/v4 4.5.1
  • golang-github-golang-jwt-jwt Debian 14, Debian 13 5.0.0+really4.5.2-1

debian advisories DEBIAN-CVE-2024-51744

  • ceph ceph storage 7.1 2:18.2.1-381.el8cp
  • ceph ceph storage 7.1 2:18.2.1-381.el9cp
  • cephadm ceph storage 7.1 2:18.2.1-381.el9cp
  • librbd1 ceph storage 7.1 2:18.2.1-381.el8cp
  • librbd1 ceph storage 7.1 2:18.2.1-381.el9cp
  • librgw2 ceph storage 7.1 2:18.2.1-381.el8cp
  • librgw2 ceph storage 7.1 2:18.2.1-381.el9cp
  • rbd-nbd ceph storage 7.1 2:18.2.1-381.el8cp

red hat advisories RHSA-2026:2769

  • release-notes-susemanager Manager Server 4.3 4.3.15.2-150400.3.133.1
  • cosign SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +9 more 2.5.0-150400.3.27.1
  • golang-github-prometheus-prometheus SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6, Manager Proxy Module 4.3 2.53.3-150100.4.23.1
  • grafana Manager Client Tools 15 10.4.13-150000.1.66.1
  • spacecmd openSUSE Leap 15.6, Manager Client Tools 15 5.0.11-150000.3.130.1
  • uyuni-tools Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.1.28-150000.1.16.1
  • dracut-saltboot openSUSE Leap 15.6, Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.1.1728559936.c16d4fb-150000.1.56.1
  • supportutils-plugin-salt SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +14 more 1.2.3-150000.3.16.1

suse advisories SUSE-SU-2025:01985-1SUSE-SU-2025:1333-1SUSE-SU-2025:0546-1SUSE-SU-2025:0525-1SUSE-SU-2025:0524-1SUSE-SU-2024:4042-1

  • kubectl-retina openSUSE Tumbleweed 1.3.1-1.1
  • kumactl openSUSE Tumbleweed 3.0.0-1.1
  • flannel openSUSE Tumbleweed 0.28.10-1.1
  • coredns openSUSE Leap 16.0 1.14.0-bp160.1.1
  • coredns Package Hub 15 SP6, openSUSE Leap 15.6 1.12.1-bp156.4.6.5
  • cosign openSUSE Tumbleweed 2.5.0-1.1
  • trivy openSUSE Tumbleweed 0.59.1-1.1
  • grafana openSUSE Tumbleweed 11.5.1-1.1

opensuse advisories openSUSE-SU-2026:12297-1openSUSE-SU-2026:12300-1openSUSE-SU-2026:12270-1openSUSE-SU-2026:20099-1openSUSE-SU-2025:0131-1openSUSE-SU-2025:14988-1

  • coredns Azure Linux 3.0 1.11.4-1
  • azcopy Azure Linux 3.0 10.25.1-4
  • cert-manager Azure Linux 3.0 1.12.15-1
  • flannel Azure Linux 3.0 0.24.2-13
  • packer Azure Linux 3.0 1.9.5-9
  • influxdb Azure Linux 3.0 2.7.5-4
  • application-gateway-kubernetes-ingress Azure Linux 3.0 1.7.7-1
  • dcos-cli Azure Linux 3.0 1.2.0-18

azure linux advisories AZL-52171AZL-52174AZL-52183AZL-52186AZL-52189AZL-52192

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-51744 updated cvss 3.1

golang-jwt: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt

  • Red Hat Builds for Red Hat OpenShift openshift-builds-waiters-rhel9, openshift-builds-webhook-rhel9, openshift-builds-controller-rhel9, openshift-builds-git-cloner-rhel9, openshift-builds-triggers-container, openshift-builds-image-bundler-rhel9, +9 more Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Cryostat 3 cryostat/cryostat-storage-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel8-operator, openshift-logging/lokistack-gateway-rhel9, openshift-logging/elasticsearch-rhel8-operator Red Hat Logical Volume Manager Storage lvms4/lvms-rhel9-operator, lvms4/lvms-must-gather-rhel9
    +12 more products
    Red Hat Migration Toolkit for Applications 7 mta/mta-hub-rhel9, mta/mta-analyzer-addon-rhel9, mta-discovery-addon-container Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-controller-rhel8 Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel8, multicluster-engine/agent-service-rhel8, multicluster-engine/hypershift-cli-rhel9, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, +8 more Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-mustgather-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8, oadp/oadp-velero-restic-restore-helper-rhel8, oadp/oadp-velero-plugin-for-microsoft-azure-rhel8 Red Hat OpenShift Developer Tools and Services odo, helm Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Serverless openshift-gitops-1/gitops-rhel8-operator, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kn-serving-queue-rhel9, openshift-serverless-1/kn-serving-webhook-rhel9, openshift-serverless-1/serving-autoscaler-rhel8, openshift-serverless-1/kn-serving-activator-rhel9, +6 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8, openshift-service-mesh/proxyv2-rhel8, openshift-service-mesh/istio-cni-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9, rhacm2/thanos-rhel7, rhacm2/volsync-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-prometheus-rhel8, rhacm2/multiclusterhub-rhel8, +7 more Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat Ansible Automation Platform 2 receptor Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Ceph Storage 6 rhceph/rhceph-promtail-rhel9, rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 8 grafana, promtail Red Hat Ceph Storage 9 grafana, promtail
    affected: no fix available
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +12 more Red Hat Enterprise Linux 9 grafana, grafana-selinux, osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 10 grafana, osbuild-composer Red Hat OpenShift AI (RHOAI) odh-operator-container, odh-training-operator-container, odh-codeflare-operator-container, odh-ml-pipelines-cache-container, odh-ml-pipelines-driver-container, odh-ml-pipelines-launcher-container, +9 more Red Hat OpenShift Cluster Manager CLI ocm-cli-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 openshift, microshift, microshift-olm, microshift-sriov, microshift-multus, openshift-clients, +43 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Openshift Data Foundation 4 odf4/mcg-cli-rhel9, odf4/odf-cli-rhel9, odf4/mcg-rhel9-operator, odf4/odf-rhel8-operator, odf4/odr-rhel9-operator, odf4/rook-ceph-rhel9-operator, +1 more Red Hat OpenShift Data Science (RHODS) rhods/odh-rhel8-operator, rhods/odh-codeflare-operator-rhel8, rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-ml-pipelines-api-server-rhel8, rhods/odh-ml-pipelines-artifact-manager-rhel8, rhods/odh-ml-pipelines-persistenceagent-rhel8, +2 more Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-argocd-rhel9-container, openshift-gitops-1/gitops-operator-bundle Red Hat OpenShift on AWS rosa Red Hat Openshift Sandboxed Containers osc-podvm-builder-container, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9
    +3 more products
    Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-ssp-operator, container-native-virtualization/kubesecondarydns-rhel9, container-native-virtualization/vm-console-proxy-rhel9, container-native-virtualization/kubevirt-ssp-operator-rhel9, container-native-virtualization/kubevirt-template-validator, container-native-virtualization/cluster-network-addons-operator, +2 more Red Hat Quay 3 quay/quay-openshift-bridge-rhel8-operator Red Hat Trusted Artifact Signer ec-rhel9, cosign-rhel9, gitsign-rhel9, tuf-server-rhel9, createctconfig-rhel9, trillian-redis-rhel9, +9 more
    affected: no fix available “Fix deferred”
  • Red Hat Ceph Storage 7.1 Tools ceph 18.2.1-381.el8cp, ceph 18.2.1-381.el9cp, cephadm 18.2.1-381.el9cp, librbd1 18.2.1-381.el8cp, librbd1 18.2.1-381.el9cp, librgw2 18.2.1-381.el8cp, +37 more
    fixed: vendor fix RHSA-2026:2769
  • Red Hat Ceph Storage 8 rhceph 1770630607
    fixed: vendor fix RHSA-2026:2737
  • Red Hat Ceph Storage 9 rhceph 1771399331
    fixed: vendor fix RHSA-2026:3406
show 1 more
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-powervs-machine-controllers-rhel9 v4.15.0-202507111906.p0.g088808b.assembly.stream.el9
    fixed: vendor fix RHSA-2025:11351

1 more fixed, 3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
GitHub 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/golang-jwt/jwt/v4
<4.5.1
4.5.1

Affected products

  • golang-jwt jwt

Classification

Weakness
  • CWE-755 Improper Handling of Exceptional Conditions
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.