{"action":"Upgrade pyjwt to 1.5.1 or later.","affected":[{"fixed":"1.5.1","introduced":"0"}],"component":"pyjwt","cve_ids":["CVE-2017-11424"],"ecosystem":"PyPI","epss":0.01804,"exploited":false,"fixed_versions":["1.5.1"],"ghsa_id":"GHSA-r9jw-mwhq-wp62","id":"tcs_01M5KG76ABK7EPD1CQXFRWFDT2","modified_at":"2023-11-08T03:58:49.234860Z","published_at":"2017-08-24T16:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-24","https://github.com/jpadilla/pyjwt/pull/277","http://www.debian.org/security/2017/dsa-3979","https://github.com/advisories/GHSA-r9jw-mwhq-wp62"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-24","url":"https://osv.dev/vulnerability/PYSEC-2017-24"}],"summary":"In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed becaus"}