GHSA-75C5-XW7C-P5PM vulnerabilities

Vulnerabilities for packages: py3-pyjwt, barman, az...

GHSA-75C5-XW7C-P5PM vulnerabilities

Vulnerabilities for packages: az, py3-pyjwt...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

PyJWT Issuer field partial matches allowed

Summary The wrong string if check is run for iss checking, resulting in "acb" being accepted for "abc". Details This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. diff - if isinstanceissuer, list: + if...

GHSA-75C5-XW7C-P5PM PyJWT Issuer field partial matches allowed

Summary The wrong string if check is run for iss checking, resulting in "acb" being accepted for "abc". Details This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. diff - if isinstanceissuer, list: + if...

CVE-2024-53861

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...

CVE-2024-53861 vulnerabilities

Vulnerabilities for packages: py3-pyjwt, barman, az...

CVE-2024-53861 vulnerabilities

Vulnerabilities for packages: az, py3-pyjwt...

CVE-2024-53861

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...

Incorrect Comparison

Overview Affected versions of this package are vulnerable to Incorrect Comparison due to an incorrect string comparison in the iss verification process. Remediation Upgrade pyjwt to version 2.10.1 or higher. References - GitHub Commit - Vulnerable Code...

CVE-2024-53861 Issuer field partial matches allowed in pyjwt

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...

CVE-2024-53861

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for "iss" checking, resulting in ""acb"" being accepted for ""abc"". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from "isinstanceissuer, list" to "isinstanceissuer, Sequence"...

CVE-2024-53861

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...

Incorrect Comparison

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Incorrect Comparison due to an incorrect string comparison in the iss verification process. Remediation Upgrade PyJWT to version 2.10.1 or higher. References - GitHub Commit - Vulnerable Cod...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

CVE-2024-53861 Issuer field partial matches allowed in pyjwt

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...

CVE-2024-53861

CVE-2024-53861 (pyjwt) : A defect in pyjwt caused by changing the iss check from a list-inclusive approach to a Sequence-based isinstance check; since str is a Sequence, the code may incorrectly evaluate string containment and permit certain values (e.g., "abc" in "abcd "), effectively altering t...