CVE-2022-29266

Apache APISIX prior to 3.13.1 is affected by an information-disclosure issue in the jwt-auth plugin. The error message returned by the dependency lua-resty-jwt can leak the user’s secret key, enabling leakage of sensitive credentials. Affected product: Apache APISIX (jwt-auth plugin); vulnerable ...

CVE-2022-29266 apisix/jwt-auth may leak secrets in error response

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information...

CVE-2022-29266: Generation of Error Message Containing Sensitive Information

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information...

activedirectoryenum (>=0.4.7, <=0.5.0), airflow-run (0.4.9) +188 more potentially affected by CVE-2020-36242 via cryptography (>=3.1.0, <=3.3.1)

cryptography PYPI version =3.1.0, =0.4.7, =0.117.0b0, =2.0.1.dev14, =8.0.1, =0.0.3, =0.9.1, =0.11.0 - azureml-accel-models 1.23.0 - azureml-cli-common 1.23.0 - azureml-contrib-fairness 1.23.0 - azureml-contrib-functions 1.23.0 - azureml-contrib-gbdt 1.23.0 - azureml-contrib-interpret 1.23.0 -...

atlassian-jwt-auth (>=1.0.9, <=3.0.0), clink (>=0.10.0, <=0.23.0) +21 more potentially affected by CVE-2017-11424 via pyjwt (>=1.0.1, <=1.5.0)

pyjwt PYPI version =1.0.1, =1.0.9, =0.10.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =1.0.0, =0.0.1, =0.9.0, =0.0.1.dev1, =0.0.1.dev3, =0.0.1.dev6 - mbq-tokens 0.0.1 and more Source cves: CVE-2017-11424 Source advisory: OSV:PYSEC-2017-24...

django-jwt-auth (0.0.1) potentially affected by CVE-2017-11424 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2017-11424 Source advisory: OSV:PYSEC-2017-24...