CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

UBUNTU-CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

aap-client-python (>=0.1.1, <=0.1.3), acapy-patched-old (0.5.6) +1014 more potentially affected by CVE-2022-29217 via pyjwt (>=1.5.0, <=2.3.0)

pyjwt PYPI version =1.5.0, =0.1.1, =0.8.44.4rc1, =1.5.2, =0.1.1, =1.5.1, =0.0.22, =0.0.96, =0.1.1, =0.1.1, =0.1.1, =2021.10.0 - airbyte-source-microsoft-teams 1.0.0 - airflow-add-ons 0.2.9b2 and more Source cves: CVE-2022-29217 Source advisory: MEND:CVE-2022-29217...

CVE-2022-29217 Key confusion through non-blocklisted public key formats in PyJWT

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

CVE-2022-29217 Key confusion through non-blocklisted public key formats in PyJWT

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

CVE-2022-29217

CVE-2022-29217 affects the Python PyJWT library (jwt handling for RFC 7519). The root cause is algorithm confusion when decoding tokens if the application does not restrict accepted algorithms; allowing unintended verification behavior across signing algorithms. The issue is mitigated by upgradin...

CVE-2022-29217 Key confusion through non-blocklisted public key formats in PyJWT

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

CVE-2022-29217: Use of a Broken or Risky Cryptographic Algorithm

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2017-11424 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2017-11424 Source advisory: OSV:GHSA-R9JW-MWHQ-WP62...

atlassian-jwt-auth (>=1.0.9, <=3.0.0), clink (>=0.10.0, <=0.23.0) +21 more potentially affected by CVE-2017-11424 via pyjwt (>=1.0.1, <=1.5.0)

pyjwt PYPI version =1.0.1, =1.0.9, =0.10.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =1.0.0, =0.0.1, =0.9.0, =0.0.1.dev1, =0.0.1.dev3, =0.0.1.dev6 - mbq-tokens 0.0.1 and more Source cves: CVE-2017-11424 Source advisory: GHSA-R9JW-MWHQ-WP62...

atlassian-jwt-auth (>=1.0.9, <=3.0.0), clink (>=0.10.0, <=0.23.0) +21 more potentially affected by CVE-2017-11424 via pyjwt (>=1.0.1, <=1.5.0)

pyjwt PYPI version =1.0.1, =1.0.9, =0.10.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =1.0.0, =0.0.1, =0.9.0, =0.0.1.dev1, =0.0.1.dev3, =0.0.1.dev6 - mbq-tokens 0.0.1 and more Source cves: CVE-2017-11424 Source advisory: OSV:GHSA-R9JW-MWHQ-WP62...

django-jwt-auth (0.0.1) potentially affected by CVE-2017-11424 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2017-11424 Source advisory: OSV:GHSA-R9JW-MWHQ-WP62...

django-googleauth-ng (>=2.1.0, <=2.3.0) potentially affected by CVE-2017-11424 via pyjwt (0.4.1)

pyjwt PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-googleauth-ng =2.1.0, =2.3.0 Source cves: CVE-2017-11424 Source advisory: OSV:GHSA-R9JW-MWHQ-WP62...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2017-11424 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2017-11424 Source advisory: OSV:GHSA-R9JW-MWHQ-WP62...

PyJWT vulnerable to key confusion attacks

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

Python encryption issue vulnerabilities

pyjwt is a Python library by the individual developer José Padilla in the United States. It allows encoding and decoding of JSON Web Tokens JWT. A cryptographic issue vulnerability exists in pyjwt versions 1.5.0 - 2.3.0, which stems from the use of a corrupted or risky cryptographic algorithm. A...

PT-2022-7130

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.4.0 Description The issue is related to the implementation of JWT in Python PyJWT, where an attacker can exploit the lack of restrictions on certain open key formats. This allows a remote attacker to impact the...