PyPI/python-jwt CVE-2022-39227: unknown, EPSS 5.34%
An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities
Action: Upgrade python-jwt to 3.3.4 or later.
pip install python-jwt==3.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.3.4 | - |
Fixed versions
| 3.3.4 |
Sources
- osv: PYSEC-2022-259
- https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9
CVE-2022-39227 · published · modified · JSON