starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-09-27 17:56:04 -04:00
Code Issues Packages Projects Releases Wiki Activity

vendor: github.com/go-jose/go-jose/v4 v4.1.5

Browse Source 
Fixed security issues

- cipher/cbc_hmac: don't panic on empty ciphertext
- cipher/cbc_hmac: don't panic on invalid key
- json: limit stack depth
- jwt: reject out-of-range NumericDate values
- Check alg against pubkey curve during verify.
- Reject malformed Ed25519 JWKs
- jws: choose verification key per-signature

Changed

- Verify OpaqueSigner's Public() return is public
- jws: skip signature on ErrJWKSKidNotFound
- Handle JWE JSON without protected header
- jws: don't strip internal whitespace before parsing JSON
- jws: fewer calls to OpaqueSigner.Public()
- Return a specific error when parsing empty string
- Reject typed nil at Verify time

full diff: https://github.com/go-jose/go-jose/compare/v4.1.4...v4.1.5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn
2026-09-03 23:40:55 +02:00
parent cec24c7b9a
commit c50ce17c19
15 changed files with 388 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor.mod
+1 -1
View File
@@ -25,7 +25,7 @@ require (
github.com/docker/go-connections v0.8.1
github.com/docker/go-units v0.5.0
github.com/fvbommel/sortorder v1.2.0
github.com/go-jose/go-jose/v4 v4.1.4
github.com/go-jose/go-jose/v4 v4.1.5
github.com/go-viper/mapstructure/v2 v2.5.0
github.com/gogo/protobuf v1.3.2
github.com/google/go-cmp v0.7.0