Skip to content
OpenAdvisories
High USN-5526-1 1 CVE

pyjwt vulnerability

Published Jul 20, 2022 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Aapo Oksman discovered that PyJWT incorrectly handled signatures
constructed from SSH public keys. A remote attacker could use this to forge
a JWT signature.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS pyjwt 1.5.3+ds1-1ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS pyjwt 1.7.1-2ubuntu2.1
Ubuntu · 22.04 LTS 22.04:LTS pyjwt 2.3.0-1ubuntu0.1

Vulnerabilities 1

  • High 7.4
    CVE-2022-29217

    Key confusion through non-blocklisted public key formats in PyJWT

    PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorith…

    jpadilla pyjwt pyjwt pyjwt Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2022-29217