x/vulndb: potential Go vuln in github.com/openshift/telemeter: CVE-2024-5037

[tatianab]

CVE-2024-5037 references github.com/kubernetes/kubernetes, which may be a Go module.

Description:
A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-5037
• JSON: https://github.com/CVEProject/cvelist/tree/e076e9c24f3ede5a41143e706602e9c41139fd45/2024/5xxx/CVE-2024-5037.json
• fix: jwt: strictly support compact serialization only kubernetes/kubernetes#123540
• web: https://access.redhat.com/security/cve/CVE-2024-5037
• web: https://bugzilla.redhat.com/show_bug.cgi?id=2272339
• web: https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78
• Imported by: https://pkg.go.dev/github.com/kubernetes/kubernetes?tab=importedby

Cross references:

• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes/pkg/kubectl/cmd/cp: GHSA-34jx-wx69-9x8v #782 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: GHSA-579h-mv94-g4gp #792 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes/pkg/kubectl/cmd/cp: GHSA-6qfg-8799-r575 #802 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: GHSA-mqf3-28j7-3mj6 #857 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes/pkg/kubelet/server: GHSA-qhm4-jxv7-j9pq #867 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes/pkg/volume/storageos: GHSA-x6mj-w4jf-jmgw #890 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes/pkg/apiserver: GHSA-xx8c-m748-xr4j #893 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: GHSA-2394-5535-8j88 #1628 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: GHSA-jh36-q97c-9928 #1629 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: CVE-2021-25736 #2159 NOT_IMPORTABLE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: CVE-2019-11246 #2230 LEGACY_FALSE_POSITIVE
• Module github.com/kubernetes/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: CVE-2019-11252 #2231 LEGACY_FALSE_POSITIVE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/kubernetes/kubernetes
      vulnerable_at: 1.30.1
      packages:
        - package: Logging Subsystem for Red Hat OpenShift
summary: CVE-2024-5037 in github.com/kubernetes/kubernetes
cves:
    - CVE-2024-5037
references:
    - fix: https://github.com/kubernetes/kubernetes/pull/123540
    - web: https://access.redhat.com/security/cve/CVE-2024-5037
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2272339
    - web: https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78
source:
    id: CVE-2024-5037
    created: 2024-06-07T17:18:06.335334-04:00
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/594901 mentions this issue: data/reports: add 18 unreviewed reports

[gopherbot]

Change https://go.dev/cl/595636 mentions this issue: data/reports: add 15 unreviewed reports

[gopherbot]

Change https://go.dev/cl/606359 mentions this issue: data/reports: regenerate 50 reports