All Versions
25
Latest Version
Avg Release Cycle
-
Latest Release
-

Changelog History
Page 1

  • v0.11.5 Changes

    ๐Ÿš€ This patch release adds additional security guards against an ECDSA bug in Java SE versions 15-15.0.6, 17-17.0.2, and 18 (CVE-2022-21449) in addition to the guards added in the JJWT 0.11.3 ๐Ÿš€ release. This patch allows JJWT users using those JVM versions to upgrade to JJWT 0.11.5, even if they are unable to โฌ†๏ธ upgrade their JVM to patched/fixed JVM version in a timely manner. Note: if your application does not use these JVM ๐Ÿ”– versions, you are not exposed to the JVM vulnerability.

    Note that the CVE is not a bug within JJWT itself - it is a bug within the above listed JVM versions, and the ๐Ÿš€ JJWT 0.11.5 release adds additional precautions within JJWT in case an application team is not able to upgrade their JVM in a timely manner.

    ๐Ÿ”’ However, even with these additional JJWT security guards, the root cause of the issue is the JVM, so it strongly โฌ†๏ธ recommended to upgrade your JVM to version 15.0.7, 17.0.3, or 18.0.1 or later to ensure the bug does not surface elsewhere in your application code or any other ๐Ÿ”’ third party library in your application that may not contain similar security guards.

    Issues included in this patch are listed in the JJWT 0.11.5 milestone.

    Credits

    ๐Ÿ”’ Thank you to Neil Madden, the security researcher that first discovered the JVM vulnerability as covered in his Psychic Signatures in Java blog post. Neil worked directly with the JJWT team to provide these additional guards, beyond what was in the JJWT 0.11.3 ๐Ÿš€ release, and we're grateful for his help and collaboration in reviewing our fixes and for the additional tests he provided the JJWT team.

  • v0.11.4 Changes

    ๐Ÿš€ This patch release:

    • โž• Adds additional handling for rare JSON parsing exceptions and wraps them in a JwtException to allow the application to handle these conditions as JWT concerns.
    • โฌ†๏ธ Upgrades the jjwt-jackson module's Jackson dependency to 2.12.6.1.
    • โฌ†๏ธ Upgrades the jjwt-orgjson module's org.json:json dependency to 20220320.
    • โฌ†๏ธ Upgrades the jjwt-gson module's gson dependency to 2.9.0.
    • ๐Ÿ“š Upgrades the internal testing BouncyCastle version and any references in README documentation examples to 1.70.
    • ๐Ÿ“š Contains various documentation and typo fixes.

    ๐Ÿ— The patch also makes various internal project POM and build enhancements to reduce repetition and the chance for ๐Ÿ— stale references, and overall create a cleaner build with less warnings. It also ensures that CI testing builds โœ… and executes on all latest OpenJDK versions from Java 7 to Java 18 (inclusive).

    Issues included in this patch are listed in the JJWT 0.11.4 milestone.

  • v0.11.3 Changes

    ๐Ÿš€ This patch release adds security guards against an ECDSA bug in Java SE versions 15-15.0.6, 17-17.0.2, and 18 (CVE-2022-21449). Note: if your application does not use these JVM versions, you are not exposed to the JVM vulnerability.

    Note that the CVE is not a bug within JJWT itself - it is a bug within the above listed JVM versions. However, even ๐Ÿ”’ with these additional JJWT security guards, the root cause of the issue is the JVM, so it strongly โฌ†๏ธ recommended to upgrade your JVM to version 15.0.7, 17.0.3, or 18.0.1 or later to ensure the bug does not surface elsewhere in your application code or any other third party library in your application that may not contain similar ๐Ÿ”’ security guards.

    Issues included in this patch are listed in the JJWT 0.11.3 milestone.

    โš  Backwards Compatibility Warning

    In addition to additional protections against r or s values of zero in ECDSA signatures, this ๐Ÿš€ release also disables by default legacy DER-encoded signatures that might be included in an ECDSA-signed JWT. ๐Ÿ‘ (DER-encoded signatures are not supported by the JWT RFC specifications, so they are not frequently encountered.)

    However, if you are using an application that needs to consume such legacy JWTs (either produced by a very early version of JJWT, or a different JWT library), you may re-enable DER-encoded ECDSA signatures by setting the io.jsonwebtoken.impl.crypto.EllipticCurveSignatureValidator.derEncodingSupported System property to the exact String value true. For example:

    System.setProperty("io.jsonwebtoken.impl.crypto.EllipticCurveSignatureValidator.derEncodingSupported", "true");
    

    BUT BE CAREFUL: DO NOT set this System property if your application may run on one of the vulnerable JVMs noted above (Java SE versions 15-15.0.6, 17-17.0.2, and 18).

    You may safely set this property to a String value of true on all other versions of the JVM if you need to support these legacy JWTs, otherwise it is best to ignore (not set) the property entirely.

    Credits

    ๐Ÿ”’ Thank you to Neil Madden, the security researcher that first discovered the JVM vulnerability as covered in his Psychic Signatures in Java blog post.

    ๐Ÿ”’ We'd also like to thank Toshiki Sasazaki, a member of LINE Corporation's Application Security โœ… Team as the first person to report the concern directly to the JJWT team, as well as for working with us during testing ๐Ÿš€ leading to our conclusions and subsequent 0.11.3 patch release.

  • v0.11.2 Changes

    ๐Ÿš€ This patch release:

    • ๐Ÿ‘ Allows empty JWS bodies to support RFC 8555 and similar initiatives. Pull Request 540
    • Ensures OSGi environments can access JJWT implementation bundles (jjwt-jackson, jjwt-gson, etc) as fragments to jjwt-api bundle. Pull Request 580
    • Rejects allowedClockSkewSeconds values that would cause numeric overflow. Issue 583
    • โฌ†๏ธ Upgrades Jackson dependency to version 2.9.10.4 to address all known Jackson CVE vulnerabilities. Issue 585
    • โšก๏ธ Updates SecretKey algorithm name validation to allow PKCS12 KeyStore OIDs in addition to JCA Names. Issue 588
    • ๐Ÿ— Enabled CI builds on JDK 14. Pull Request 590
    • โž• Adds missing parameters type to Maps.add(), which removes an unchecked type warning. Issue 591
    • Ensures GsonDeserializer always uses UTF-8 for encoding bytes to Strings. Pull Request 592

    All issues and PRs are listed in the Github JJWT 0.11.2 milestone.

  • v0.11.1 Changes

    ๐Ÿš€ This patch release:

    • โฌ†๏ธ Upgrades the jjwt-jackson module's Jackson dependency to 2.9.10.3.
    • ๐Ÿ›  Fixes an issue when using Java 9+ Map.of with JacksonDeserializer that resulted in an NullPointerException.
    • ๐Ÿ›  Fixes an issue that prevented the jjwt-gson .jar's seralizer/deserializer implementation from being detected automatically.
    • Ensures service implementations are now loaded from the context class loader, Services.class.classLoader, and the system classloader, the first classloader with a service wins, and the others are ignored. This mimics how Classes.forName() works, and how JJWT attempted to auto-discover various implementations in previous versions.
    • ๐Ÿ›  Fixes a minor error in the Claims#getIssuedAt JavaDoc.
  • v0.11.0 Changes

    ๐Ÿš€ This minor release:

    • โž• Adds Google's Gson as a natively supported JSON parser. Installation instructions have been updated and new JJWT Gson usage guidelines have been added.
    • ๐Ÿš€ Updates the Jackson dependency version to 2.9.10 ๐Ÿ”’ to address three security vulnerabilities in Jackson.
    • ๐Ÿšš A new JwtParserBuilder interface has been added and is the recommended way of creating an immutable and thread-safe JwtParser instance. Mutable methods in JwtParser will be removed before v1.0. Migration to the new signatures is straightforward, for example:

      Previous Version:

       Jwts.parser()
           .requireAudience("string")
           .parse(jwtString)
      

      Current Version:

      Jwts.parserBuilder()
          .requireAudience("string")
          .build()
          .parse(jwtString)
      
    • โž• Adds io.jsonwebtoken.lang.Maps utility class to make creation of maps fluent, as demonstrated next.

    • โž• Adds support for custom types when deserializing with Jackson. To use configure your parser:

      Jwts.parserBuilder().deserializeJsonWith(
          new JacksonDeserializer(
              Maps.of("claimName", YourType.class).build() // <--
          )
      ).build()
      
    • ๐Ÿ“ฆ Moves JSON Serializer/Deserializer implementations to a different package name.

      • io.jsonwebtoken.io.JacksonSerializer -> io.jsonwebtoken.jackson.io.JacksonSerializer
      • io.jsonwebtoken.io.JacksonDeserializer -> io.jsonwebtoken.jackson.io.JacksonDeserializer
      • io.jsonwebtoken.io.OrgJsonSerializer -> io.jsonwebtoken.orgjson.io.OrgJsonSerializer
      • io.jsonwebtoken.io.OrgJsonDeserializer -> io.jsonwebtoken.orgjson.io.OrgJsonDeserializer

    A backward compatibility modules has been created using the deprecated classifier (io.jsonwebtoken:jjwt-jackson:0.11.0:deprecated and io.jsonwebtoken:jjwt-orjson:0.11.0:deprecated), if you are compiling against these classes directly, otherwise you will be unaffected.

    โš  Backwards Compatibility Warning

    ๐Ÿ“ฆ Due to this package move, if you are currently using one of the above four existing (pre 0.11.0) classes with compile scope, you must either:

    1. change your code to use the newer package classes (recommended), or
    2. change your build/dependency configuration to use the deprecated dependency classifier to use the existing classes, as follows:

    Maven

    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.0</version>
        <classifier>deprecated</classifier>
        <scope>compile</scope>
    </dependency>
    

    Gradle

    compile 'io.jsonwebtoken:jjwt-jackson:0.11.0:deprecated'
    

    Note: that the first option is recommended since the second option will not be available starting with the 1.0 release.

  • v0.10.8 Changes

    ๐Ÿš€ This patch release:

    • Ensures that SignatureAlgorithms PS256, PS384, and PS512 work properly on JDK 11 and later without the need for BouncyCastle. Previous releases referenced a BouncyCastle-specific algorithm name instead of the Java Security Standard Algorithm Name of RSASSA-PSS. This release ensures the standard name is used moving forward.

    • ๐Ÿ›  Fixes a backwards-compatibility bug when parsing compressed JWTs created from 0.10.6 or earlier using the DEFLATE compression algorithm.

  • v0.10.7 Changes

    ๐Ÿš€ This patch release:

    • โž• Adds a new Community section in the documentation discussing asking questions, using Slack and Gittr, and opening new issues and pull requests.
    • ๐Ÿ›  Fixes a memory leak found in the DEFLATE compression codec implementation.
    • ๐Ÿš€ Updates the Jackson dependency version to 2.9.9.1 ๐Ÿ”’ to address three security vulnerabilities in Jackson: CVE-2019-12086, CVE-2019-12384, and CVE-2019-12814.
    • ๐Ÿ›  Fixes a bug when Jackson is in the classpath but the jjwt-jackson .jar is not.
    • ๐Ÿ›  Fixes various documentation and typo fixes.
  • v0.10.6 Changes

    ๐Ÿš‘ This patch release updates the jackson-databind version to 2.9.8 to address a critical security vulnerability in that library.

  • v0.10.5 Changes

    ๐Ÿš€ This patch release fixed an Android org.json library compatibility issue.