Fedora 27 : python-jwt (2017-0cc84101de)

Upgrade to 1.5.3 and also note that 1.5.1 fixed CVE-2017-11424. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

PT-2018-8620

Name of the Vulnerable Software and Affected Versions: Cisco node-jose versions prior to 0.11.0 Description: A security issue exists due to the node-jose library following the JSON Web Signature JWS standard for JSON Web Tokens JWTs, which allows a JSON Web Key JWK representing a public key to be...

CVE-2018-0114: Improper Verification of Cryptographic Signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

Code injection

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

CVE-2017-10862

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

CVE-2017-10862

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

CVE-2017-10862

CVE-2017-10862 affects the jwt-scala library; versions 1.2.2 and earlier fail to verify token signatures correctly due to improper processing of JWT headers. This can allow an attacker to present specially crafted JWT data that is accepted as correctly signed. The issue is documented in sources s...

CVE-2017-10862

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

PT-2017-11566

Name of the Vulnerable Software and Affected Versions jwt-scala versions 1.2.2 and earlier Description The issue is related to the incorrect verification of token signatures, potentially allowing an attacker to pass specially crafted JWT data as a correctly signed token. Recommendations For...

CVE-2017-10862: Insufficient Verification of Data Authenticity

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

Fedora Update for python-jwt FEDORA-2017-b9f07dfaca

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

jwt-scala fails to verify token signatures

Overview jwt-scala contains a vulnerability where it fails to verify token signatures correctly. jwt-scala is a Scala library to handle JSON Web Token JWT. jwt-scala contains a vulnerability where it fails to verify token signatures correctly due to improper processing of JWT headers. Toshiharu...

Fedora 26 : python-jwt (2017-b9f07dfaca)

Upgrade to 1.5.3 and also note that 1.5.1 fixed CVE-2017-11424. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Timing Attack

emarref/jwt is vulnerable to a timing attack. It is possible because the verify function in Symmetric.php does not compare hashes in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...

CVE-2017-11424

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

django-jwt-auth (0.0.1) potentially affected by CVE-2017-11424 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2017-11424 Source advisory: OSV:PYSEC-2017-24...

Type confusion

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2017-11424 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2017-11424 Source advisory: OSV:PYSEC-2017-24...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2017-11424 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2017-11424 Source advisory: OSV:PYSEC-2017-24...

atlassian-jwt-auth (>=1.0.9, <=3.0.0), clink (>=0.10.0, <=0.23.0) +21 more potentially affected by CVE-2017-11424 via pyjwt (>=1.0.1, <=1.5.0)

pyjwt PYPI version =1.0.1, =1.0.9, =0.10.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =1.0.0, =0.0.1, =0.9.0, =0.0.1.dev1, =0.0.1.dev3, =0.0.1.dev6 - mbq-tokens 0.0.1 and more Source cves: CVE-2017-11424 Source advisory: OSV:PYSEC-2017-24...