PyPI/python-jwt CVE-2022-39227: critical 9.1, EPSS 5.34%

python-jwt vulnerable to token forgery with new claims

Action: Upgrade python-jwt to 3.3.4 or later.

pip install python-jwt==3.3.4

Affected

Fixed versions

Sources

• osv: GHSA-5p8v-58qm-c7fp
• https://github.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fp
• https://nvd.nist.gov/vuln/detail/CVE-2022-39227
• https://github.com/davedoesdev/python-jwt/commit/6c5075469847b9e8b6e5336077d989d77a4d2bf1
• https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9
• https://github.com/davedoesdev/python-jwt
• https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yaml
• https://www.vicarius.io/vsociety/posts/authentication-bypass-in-python-jwt

CVE-2022-39227 · published 2022-09-21T21:33:22Z · modified 2024-07-10T21:46:12.326522Z · JSON