CVE-2022-39227
2 advisories.
PyPI/python-jwt CVE-2022-39227: critical 9.1
python-jwt vulnerable to token forgery with new claims
Action: Upgrade python-jwt to 3.3.4 or later.
pip install python-jwt==3.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.3.4 | - |
Fixed versions
| 3.3.4 |
Sources
- osv: GHSA-5p8v-58qm-c7fp
- https://github.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fp
- https://nvd.nist.gov/vuln/detail/CVE-2022-39227
- https://github.com/davedoesdev/python-jwt/commit/6c5075469847b9e8b6e5336077d989d77a4d2bf1
- https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9
- https://github.com/davedoesdev/python-jwt
- https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yaml
- https://www.vicarius.io/vsociety/posts/authentication-bypass-in-python-jwt
CVE-2022-39227 · published · modified · JSON
PyPI/python-jwt CVE-2022-39227: unknown
An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities
Action: Upgrade python-jwt to 3.3.4 or later.
pip install python-jwt==3.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.3.4 | - |
Fixed versions
| 3.3.4 |
Sources
- osv: PYSEC-2022-259
- https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9
CVE-2022-39227 · published · modified · JSON