Security Vulnerability: Upgrade jsonwebtoken dependency due to vulnerable ring crate

[shiftcontrol-dan]

The propelauth crate currently depends on jsonwebtoken version 8.3.0, which in turn relies on ring version 0.16.20. A recent security advisory (RUSTSEC-2025-0009) has identified that ring version 0.16.20 may panic under certain circumstances when overflow checking is enabled, specifically involving AES functions.

Dependency Chain:

ring 0.16.20
└── jsonwebtoken 8.3.0
└── propelauth 0.23.0

Crate:     ring
Version:   0.16.20
Title:     Some AES functions may panic when overflow checking is enabled.
Date:      2025-03-06
ID:        RUSTSEC-2025-0009
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0009
Solution:  Upgrade to >=0.17.12
Dependency tree:
ring 0.16.20
└── jsonwebtoken 8.3.0
    └── propelauth 0.23.0
        └── shiftcontrol-saas-service-api 0.6.12

Recommended Solution:
The recommended fix is to upgrade the dependency on jsonwebtoken to version >=9.0, as it depends on the secure version of ring (>=0.17.12). However, it's acknowledged that jsonwebtoken v9.x introduces breaking changes according @mrmauer here: #61 (review)

Impact:
Users of propelauth currently experience issues with cargo audit, and staying on the outdated ring version could pose security risks.

Request:
Please address this security concern by upgrading jsonwebtoken to a secure version (v9.x). If breaking changes complicate an immediate upgrade, guidance or a timeline on when this upgrade can be expected would be helpful.

[mrmauer]

Thanks for reporting, @shiftcontrol-dan. We've just shipped 0.23.1 which removes any dependency on the ring version in question and passes cargo audit. Let us know if you need any further support.

It's also important to state the impact here: The vulnerability in the ring crate version was a DOS attack that requires a >= 64GB payload sent for encryption on a QUIC protocol. The propelauth crate uses TLS and does not provide any feature enabling QUIC, so there's no opening for the DOS described in the above RUSTSEC report.

Again, thanks for raising the issue regardless, and for any future security concern you may have emailing security@propelauth.com will generally get the fastest response.

[shiftcontrol-dan]

Thanks! Yes, I realize the impact wasn't high, but glad you were able to fix. At the very least it stops me from having to ignore it in cargo audit and dependabot :)
I'll send these to security@ next time!