CVE-2022-29217

 

Published at: - 24-05-2022 05:15

Last modified: - 07-06-2022 04:40

Total changes: - 3

Description

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms=jwt.algorithms.get_default_algorithms()` has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24
• https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc
• https://github.com/jpadilla/pyjwt/releases/tag/2.4.0
• FEDORA-2022-3cf456dc20-Mailing List, Third Party Advisory
• FEDORA-2022-4ae9110f51-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2022-29217

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures