REDHAT-BUG-2482734: High severity pypi/pyjwt vulnerability
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyJWTto a version that resolves this vulnerability.Fixed in 2.13.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2482734?
The severity of REDHAT-BUG-2482734 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2482734?
To fix REDHAT-BUG-2482734, upgrade the PyJWT library to version 2.13.0 or later.
What is the impact of REDHAT-BUG-2482734?
The impact of REDHAT-BUG-2482734 allows attackers to exploit the HMAC algorithm without proper validation of JSON Web Keys.
Is REDHAT-BUG-2482734 related to JSON Web Tokens?
Yes, REDHAT-BUG-2482734 affects the PyJWT library, which implements JSON Web Tokens in Python.
Who is affected by REDHAT-BUG-2482734?
Users of the PyJWT library prior to version 2.13.0 are affected by REDHAT-BUG-2482734.