CVE-2017-11424: High severity pyjwt vulnerability
In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11424?
CVE-2017-11424 has been assigned a medium severity rating due to its potential to allow unauthorized access through certain PEM encoded keys.
How do I fix CVE-2017-11424?
To fix CVE-2017-11424, upgrade PyJWT to version 1.5.1 or later.
Which versions of PyJWT are affected by CVE-2017-11424?
CVE-2017-11424 affects PyJWT versions 1.5.0 and below.
What types of keys are impacted by CVE-2017-11424?
CVE-2017-11424 specifically impacts PEM encoded keys that are in PKCS1 format.
Is Debian Linux affected by CVE-2017-11424?
Yes, Debian Linux versions 8.0 and 9.0 are affected by CVE-2017-11424 due to their inclusion of the vulnerable PyJWT package.