PRISMA-2022-0270 security vulnerability in version v4.4.2
vishweshwarp opened this issue · comments
Found the vulnerability with CVE code PRISMA-2022-0270 in version v4.4.2. Can we get this fixed?
Vulnerability description:
github.com/golang-jwt/jwt/v4 module from all versions is vulnerable to Denial of Service (DoS) due to token without ExpiresAt can cause panic.
the 4.4.3 release is still beeing flaged by Prisma Cloud as a vulnerability sadly
That is the problem with using some cloud security software from a vendor, which does not even bother reporting it to the original repo but just assigning a proprietary own number. It has no assigned CVE number. The actual CVE 2022-0270 is from a totally different product. Not sure what else we can do from our side on this.
I suggest we close this issue. Not much more to do here and @oxisto answer's are spot on.