CVE-2024-37568: High severity authlib vulnerability
Published Jun 9, 2024
·Updated
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
Affected Software
2 affected componentsFixes available
pip/authlib>=0<1.3.1
1.3.1
Authlib Authlib<1.3.1
Event History
Jun 9, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-37568?
CVE-2024-37568 is classified as a medium severity vulnerability due to potential HMAC verification risks with asymmetric public keys.
2
How do I fix CVE-2024-37568?
To fix CVE-2024-37568, upgrade Authlib to version 1.3.1 or later.
3
What type of attack does CVE-2024-37568 expose software to?
CVE-2024-37568 exposes software to risks of algorithm confusion attacks, allowing unauthorized HMAC verification.
4
Which versions of Authlib are affected by CVE-2024-37568?
Authlib versions prior to 1.3.1 are affected by CVE-2024-37568.
5
Is there a workaround for CVE-2024-37568 if I cannot upgrade?
A workaround for CVE-2024-37568 involves explicitly specifying the algorithm in the jwt.decode call.