nats-io/jwt/v2 & nats-io/nats-server/v2 vulnerability issues CVE-2021-3127 & CVE-2022-24450

[denopink]

What did you do?

Run dependency check in a project with go-kit 0.12.0 for known vulnerabilities.

What did you expect?

Run dependency check with go-kit without vulnerabilities medium or higher.

What happened instead?

Current version of https://github.com/nats-io/jwt/v2 (v2.0.3) and github.com/nats-io/nats-server/v2 (v2.5.0) are affected by CVE-2021-3127 & CVE-2022-24450 in that this project got flagged by security scans. Both of these libs at their current version require nats-io/jwt v1.2.2 or nats-io/jwt/v2 v2.0.3 (which itself requires nats-io/jwt v1.2.2) and are both affected by CVE-2021-3127. nats-io/nats-server/v2 >= 2.7.2 patches CVE-2022-24450

[TheoBrigitte]

Hitting following CVEs from security scan report : CVE-2022-24450 and CVE-2022-29946.

The linked PR solves those.