Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Debian · 8 | pyjwt | 0.2.1-1+deb8u2 |
| Debian · 9 | pyjwt | 1.4.2-1+deb9u1 |
Vulnerabilities 1
-
High 7.5
PyJWT vulnerable to key confusion attacks
In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY…