Skip to content
OpenAdvisories
Medium ALAS2023-2023-076 1 CVE

Moderate: python-jwt security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-29217: A vulnerability was found in python-jwt. This issue happens when PyJWT supports multiple different JWT signing algorithms. This flaw allows an attacker submitting the JWT token to choose the used signing algorithm, leading to key confusion through non-blocklisted public key formats.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 python3-jwt 0:2.4.0-1.amzn2023.0.1
Amazon Linux · 2023 python3-jwt+crypto 0:2.4.0-1.amzn2023.0.1

Vulnerabilities 1

  • High 7.4
    CVE-2022-29217

    Key confusion through non-blocklisted public key formats in PyJWT

    PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorith…

    jpadilla pyjwt pyjwt pyjwt Debian Ubuntu Azure Linux Alpine PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29217.html