lightrag-hku: JWT Algorithm Confusion Vulnerability

SummaryThe LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leadi...

OESA-2022-1710 python-jwt security update

PyJWT is a Python library which allows you to encode and decode JSON Web Tokens JWT. \ JWT is an open, industry-standard RFC 7519 for representing claims securely between two parties. Security Fixes: PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing...

AZL-9852 CVE-2022-29217 affecting package python-jwt for versions less than 2.4.0-1

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

DEBIAN-CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

PYSEC-2022-202

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

UBUNTU-CVE-2022-29217

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...

PT-2022-7130

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.4.0 Description The issue is related to the implementation of JWT in Python PyJWT, where an attacker can exploit the lack of restrictions on certain open key formats. This allows a remote attacker to impact the...