Lucene search
MitreCVELIST:CVE-2024-37568HistoryJun 09, 2024 - 12:00 a.m.
CVE-2024-37568
2024-06-0900:00:00
mitre
www.cve.org
1
lepture authlib
algorithm confusion
asymmetric public keys
jwt.decode
hmac verification
0.001 Low
EPSS
Percentile
45.6%
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
Related
github
github
Authlib has algorithm confusion with asymmetric public keys
2024-06-09 21:30:33
python-jose algorithm confusion with OpenSSH ECDSA keys
2024-04-26 00:30:35
Key confusion through non-blocklisted public key formats
2022-05-24 22:17:27
nvd
nvd
debiancve
debiancve
mageia
mageia
Updated python-authlib packages fix security vulnerability
2024-06-25 19:12:04
Updated python-pyjwt packages fix security vulnerability
2022-07-01 00:31:09
openvas
openvas
Mageia: Security Advisory (MGASA-2024-0238)
2024-06-26 00:00:00
openSUSE: Security Advisory for python (SUSE-SU-2024:2064-1)
2024-06-19 00:00:00
Fedora: Security Advisory for python-authlib (FEDORA-2024-7cc9a030d9)
2024-06-19 00:00:00
osv
osv
CVE-2024-37568
2024-06-09 19:15:52
Authlib has algorithm confusion with asymmetric public keys
2024-06-09 21:30:33
PYSEC-2024-52
2024-06-09 19:15:00
cve
cve
ubuntucve
ubuntucve
cvelist
cvelist
CVE-2024-33663
2024-04-25 00:00:00
redhatcve
redhatcve
CVE-2024-33663
2024-04-26 06:04:23
CVE-2022-29217
2022-05-25 02:21:09
nessus
nessus
openSUSE 15 Security Update : python-python-jose (openSUSE-SU-2024:0118-1)
2024-05-08 00:00:00
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Authlib (SUSE-SU-2024:2064-1)
2024-06-19 00:00:00
Fedora 40 : python-authlib (2024-7cc9a030d9)
2024-06-18 00:00:00
veracode
veracode
Authentication Bypass
2024-06-12 05:44:58
Improper Signature Validation
2024-04-29 06:33:23
Authentication Bypass
2022-05-25 07:35:03
fedora
fedora
[SECURITY] Fedora 39 Update: python-authlib-1.3.1-1.fc39
2024-06-20 08:01:56
[SECURITY] Fedora 40 Update: python-authlib-1.3.1-1.fc40
2024-06-18 10:07:35
[SECURITY] Fedora 35 Update: python-jwt-2.4.0-1.fc35
2022-06-01 01:27:09
suse
suse
Security update for python-PyJWT (important)
2022-07-14 00:00:00
prion
prion
Code injection
2022-05-24 15:15:00
ubuntu
ubuntu
PyJWT vulnerability
2022-07-20 00:00:00
cbl_mariner
cbl_mariner
CVE-2022-29217 affecting package python-jwt 1.7.1-9
2022-07-14 20:59:55
CVE-2022-29217 affecting package python-jwt for versions less than 2.4.0-1
2022-06-26 03:29:33
ibm
ibm
alpinelinux
alpinelinux
CVE-2022-29217
2022-05-24 15:15:07
redos
redos
ROS-20240619-01
2024-06-19 00:00:00