cumulusci (>=3.38.0.dev1, <=3.40.2.dev1), daml-dit-if (>=0.6.0, <=0.6.12) +1 more potentially affected by CVE-2023-6681 via jwcrypto (0.9.1)

jwcrypto PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on jwcrypto and may be impacted: - cumulusci =3.38.0.dev1, =0.6.0, =0.1.0, =0.9.0 Source cves: CVE-2023-6681 Source advisory: OSV:GHSA-CW2R-4P82-QV79...

sdc-cryptography (0.2.3), yesaide (1.4.4) potentially affected by CVE-2023-6681 via jwcrypto (0.5.0)

jwcrypto PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on jwcrypto and may be impacted: - sdc-cryptography 0.2.3 - yesaide 1.4.4 Source cves: CVE-2023-6681 Source advisory: OSV:GHSA-CW2R-4P82-QV79...

alastria-auth (>=0.0.3, <=0.0.17), alastria-identity (>=0.2.0, <=0.4.0) +9 more potentially affected by CVE-2023-6681 via jwcrypto (0.8.0)

jwcrypto PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on jwcrypto and may be impacted: - alastria-auth =0.0.3, =0.2.0, =0.4.0a0, =0.1.0.2, =3.18.0, =0.1.0, =0.0.1, =1.0.6, =1.0.0, =2.7.1, =3.1.3 Source cves: CVE-2023-6681 Source...

aup-manager (>=2.0.0, <=2.0.1), ceramic-python (>=0.1.0, <=0.1.7) +17 more potentially affected by CVE-2023-6681 via jwcrypto (>=1.0.0, <=1.5.0)

jwcrypto PYPI version =1.0.0, =2.0.0, =0.1.0, =0.1.0, =3.41.0, =0.0.0.1, =2.5.0, =0.1.0, =0.22.1, =0.4.0, =0.0.2, =0.2.0, =1.0.4, =48.0.4034, =51.0.0.2.575 and more Source cves: CVE-2023-6681 Source advisory: GHSA-CW2R-4P82-QV79...

PT-2023-32738

Name of the Vulnerable Software and Affected Versions JWCrypto affected versions not specified Description A flaw was found in JWCrypto, allowing an attacker to cause a denial of service DoS attack and making password brute-force and dictionary attacks more resource-intensive. This issue results ...

ipa bug fix update

An update is available for custodia, module.custodia, pyusb, python-qrcode, module.slapi-nis, module.pyusb, module.softhsm, python-jwcrypto, python-kdcproxy, module.opendnssec, module.python-kdcproxy, module.ipa, ipa-healthcheck, softhsm, module.python-jwcrypto, ipa, opendnssec, python-yubico,...

DL1 bug fix and enhancement update

An update is available for custodia, module.custodia, pyusb, python-qrcode, module.slapi-nis, module.pyusb, module.softhsm, python-jwcrypto, python-kdcproxy, module.opendnssec, module.python-kdcproxy, module.ipa, ipa-healthcheck, softhsm, module.python-jwcrypto, ipa, opendnssec, python-yubico,...

DL1 bug fix and enhancement update

An update is available for ipa, python-jwcrypto, custodia, bind-dyndb-ldap, python-qrcode, softhsm, slapi-nis, python-yubico, python-kdcproxy, opendnssec, ipa-healthcheck, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

python-jwt vulnerable to token forgery with new claims

Impact An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Patches Users should upgrade to version...

Authorization Bypass

jwcrypto is vulnerable to authorization bypass. The vulnerability is due to JWT auto-detecting the token type; under certain circumstances, it's possible to substitute a signed JWS token with a JWE token encrypted with the public key used for signature validation...

new packages: python-jwcrypto

An update is available for python-jwcrypto. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-WG33-X934-3GHH jwcrypto lacks the Random Filling protection mechanism

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

jwcrypto lacks the Random Filling protection mechanism

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

idm:DL1 security update

An update is available for ipa, python-jwcrypto, custodia, bind-dyndb-ldap, python-qrcode, softhsm, slapi-nis, python-yubico, python-kdcproxy, opendnssec, ipa-healthcheck, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

ipa bug fix and enhancement update

An update is available for ipa, python-jwcrypto, custodia, bind-dyndb-ldap, python-qrcode, softhsm, slapi-nis, python-yubico, python-kdcproxy, opendnssec, ipa-healthcheck, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

idm:DL1 and idm:client security, bug fix, and enhancement update

An update is available for ipa, python-jwcrypto, custodia, bind-dyndb-ldap, python-qrcode, softhsm, python-yubico, python-kdcproxy, opendnssec, ipa-healthcheck, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

DL1 bug fix and enhancement update

An update is available for python-jwcrypto, custodia, python-qrcode, python-yubico, python-kdcproxy, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Rocky...

DL1 bug fix update

An update is available for python-jwcrypto, custodia, python-qrcode, python-yubico, python-kdcproxy, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Rocky...

idm:DL1 and idm:client security, bug fix, and enhancement update

An update is available for python-jwcrypto, custodia, python-qrcode, python-yubico, python-kdcproxy, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Rocky...

DL1 bug fix and enhancement update

An update is available for python-jwcrypto, custodia, python-qrcode, python-yubico, python-kdcproxy, pyusb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For...