Lucene search
Veracode Vulnerability DatabaseVERACODE:35701HistoryMay 25, 2022 - 7:35 a.m.
Authentication Bypass
2022-05-2507:35:03
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
51
0.001 Low
EPSS
Percentile
45.7%
pyjwt is vulnerable to authentication bypass. The vulnerability exists because the library permits an attacker submitting a JWT token to choose which algorithms are used when signing in, enabling non-blocklisted, but weak public key formats to be supported in the authentication process allowing an attacker to perform unauthorized actions.
References
github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc
github.com/jpadilla/pyjwt/releases/tag/2.4.0
github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24
lists.fedoraproject.org/archives/list/[email protected]/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX/
lists.fedoraproject.org/archives/list/[email protected]/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO/
Related
nvd
nvd
cbl_mariner
cbl_mariner
CVE-2022-29217 affecting package python-jwt 1.7.1-9
2022-07-14 20:59:55
CVE-2022-29217 affecting package python-jwt for versions less than 2.4.0-1
2022-06-26 03:29:33
redhatcve
redhatcve
CVE-2022-29217
2022-05-25 02:21:09
CVE-2024-33663
2024-04-26 06:04:23
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2023:0794-1)
2023-03-28 00:00:00
Fedora: Security Advisory for python-jwt (FEDORA-2022-3cf456dc20)
2022-05-28 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3545-1)
2022-10-07 00:00:00
nessus
nessus
SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2022:2402-1)
2022-07-15 00:00:00
Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2023-076)
2023-03-21 00:00:00
SUSE SLES15 Security Update : python-PyJWT (SUSE-SU-2022:2403-1)
2022-07-15 00:00:00
suse
suse
Security update for python-PyJWT (important)
2022-07-14 00:00:00
prion
prion
Code injection
2022-05-24 15:15:00
ubuntu
ubuntu
PyJWT vulnerability
2022-07-20 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: python-jwt-2.4.0-1.fc36
2022-05-27 01:10:44
[SECURITY] Fedora 35 Update: python-jwt-2.4.0-1.fc35
2022-06-01 01:27:09
cve
cve
osv
osv
Key confusion through non-blocklisted public key formats
2022-05-24 22:17:27
pyjwt vulnerability
2022-07-20 01:09:23
CVE-2022-29217
2022-05-24 15:15:07
ibm
ibm
debiancve
debiancve
alpinelinux
alpinelinux
CVE-2022-29217
2022-05-24 15:15:07
mageia
mageia
Updated python-pyjwt packages fix security vulnerability
2022-07-01 00:31:09
Updated python-authlib packages fix security vulnerability
2024-06-25 19:12:04
github
github
Key confusion through non-blocklisted public key formats
2022-05-24 22:17:27
python-jose algorithm confusion with OpenSSH ECDSA keys
2024-04-26 00:30:35
Authlib has algorithm confusion with asymmetric public keys
2024-06-09 21:30:33
cvelist
cvelist
CVE-2024-33663
2024-04-25 00:00:00
CVE-2024-37568
2024-06-09 00:00:00
ubuntucve
ubuntucve