PyPI/pyjwt CVE-2022-29217: high 7.4, EPSS 1.35%

Key confusion through non-blocklisted public key formats

Action: Upgrade pyjwt to 2.4.0 or later.

pip install pyjwt==2.4.0

Affected

Fixed versions

Sources

• osv: GHSA-ffqj-6fqr-9h24
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24
• https://nvd.nist.gov/vuln/detail/CVE-2022-29217
• https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc
• https://github.com/jpadilla/pyjwt
• https://github.com/jpadilla/pyjwt/releases/tag/2.4.0
• https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2022-202.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO

CVE-2022-29217 · published 2022-05-24T22:17:27Z · modified 2024-10-15T16:27:42.751871Z · JSON