CVE-2022-29217
2 advisories.
PyPI/pyjwt CVE-2022-29217: high 7.4
Key confusion through non-blocklisted public key formats
Action: Upgrade pyjwt to 2.4.0 or later.
pip install pyjwt==2.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.5.0 | 2.4.0 | - |
Fixed versions
| 2.4.0 |
Sources
- osv: GHSA-ffqj-6fqr-9h24
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24
- https://nvd.nist.gov/vuln/detail/CVE-2022-29217
- https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc
- https://github.com/jpadilla/pyjwt
- https://github.com/jpadilla/pyjwt/releases/tag/2.4.0
- https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2022-202.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO
CVE-2022-29217 · published · modified · JSON
PyPI/pyjwt CVE-2022-29217: unknown
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT
Action: Upgrade pyjwt to 2.4.0 or later.
pip install pyjwt==2.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.5.0 | 2.4.0 | - |
Fixed versions
| 2.4.0 |
Sources
- osv: PYSEC-2022-202
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24
- https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc
- https://github.com/jpadilla/pyjwt/releases/tag/2.4.0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX/
CVE-2022-29217 · published · modified · JSON