CVE-2022-29266

Apache APISIX prior to 3.13.1 is affected by an information-disclosure issue in the jwt-auth plugin. The error message returned by the dependency lua-resty-jwt can leak the user’s secret key, enabling leakage of sensitive credentials. Affected product: Apache APISIX (jwt-auth plugin); vulnerable ...

CVE-2022-29266 apisix/jwt-auth may leak secrets in error response

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information...

CVE-2022-29266 apisix/jwt-auth may leak secrets in error response

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information...

CVE-2022-29266: Generation of Error Message Containing Sensitive Information

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information...

activedirectoryenum (>=0.4.7, <=0.5.0), airflow-run (0.4.9) +188 more potentially affected by CVE-2020-36242 via cryptography (>=3.1.0, <=3.3.1)

cryptography PYPI version =3.1.0, =0.4.7, =0.117.0b0, =2.0.1.dev14, =8.0.1, =0.0.3, =0.9.1, =0.11.0 - azureml-accel-models 1.23.0 - azureml-cli-common 1.23.0 - azureml-contrib-fairness 1.23.0 - azureml-contrib-functions 1.23.0 - azureml-contrib-gbdt 1.23.0 - azureml-contrib-interpret 1.23.0 -...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2020-25659 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

atlassian-jwt-auth (>=2.8.1, <=2.10.0), fallixy (0.18.1) +3 more potentially affected by CVE-2020-25659 via cryptography (1.5.3)

cryptography PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.8.1, =0.18.1, =0.9.0, =1.1.0 - teamvault 0.6.0 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

atlassian-jwt-auth (>=2.10.1, <=3.0.1), mitmproxy (>=2.0.1, <=2.0.2) +10 more potentially affected by CVE-2020-25659 via cryptography (1.8.2)

cryptography PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.10.1, =2.0.1, =0.1.2, =0.4.0, =0.0.1, =1.3.6, =2.4.6, =1.1.1, =1.4.0, =1.5.0 Source cves: CVE-2020-25659 Source...

atlassian-jwt-auth (>=2.2.0, <=2.4.0) potentially affected by CVE-2020-25659 via cryptography (1.2.1)

cryptography PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.2.0, =2.4.0 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

atlassian-jwt-auth (1.0.9) potentially affected by CVE-2020-25659 via cryptography (0.9.1)

cryptography PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 1.0.9 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2020-25659 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

atlassian-jwt-auth (2.1.1), pyupdater (1.1.8) potentially affected by CVE-2020-25659 via cryptography (1.1.1)

cryptography PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.1.1 - pyupdater 1.1.8 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

atlassian-jwt-auth (>=2.5.1, <=2.8.0), data-pipeline (>=0.9.5, <=0.9.12) potentially affected by CVE-2020-25659 via cryptography (1.3.4)

cryptography PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.5.1, =0.9.5, =0.9.12 Source cves: CVE-2020-25659 Source advisory: OSV:PYSEC-2021-62...

atlassian-jwt-auth (1.0.9) potentially affected by CVE-2020-25659 via cryptography (0.9.1)

cryptography PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 1.0.9 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...

atlassian-jwt-auth (>=2.2.0, <=2.4.0) potentially affected by CVE-2020-25659 via cryptography (1.2.1)

cryptography PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.2.0, =2.4.0 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...

atlassian-jwt-auth (>=2.5.1, <=2.8.0), data-pipeline (>=0.9.5, <=0.9.12) potentially affected by CVE-2020-25659 via cryptography (1.3.4)

cryptography PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.5.1, =0.9.5, =0.9.12 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...

atlassian-jwt-auth (2.1.1), pyupdater (1.1.8) potentially affected by CVE-2020-25659 via cryptography (1.1.1)

cryptography PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.1.1 - pyupdater 1.1.8 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...

atlassian-jwt-auth (3.1.0), igitt (>=0.4.1.dev20171005105713, <=0.4.1.dev20171202111001) +4 more potentially affected by CVE-2020-25659 via cryptography (2.0.3)

cryptography PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 3.1.0 - igitt =0.4.1.dev20171005105713, =0.3.2, =0.1.4, =1.4.5, =1.4.9 Source cves: CVE-2020-25659 Source advisory:...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2020-25659 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2020-25659 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...