PT-2017-12006 · Python+1 · Pyjwt+1

Jpadilla · Publicado 2017-08-24 · Atualizado 2022-05-13 · CVE-2017-11424

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PyJWT versions 1.5.0 and below

Description The issue concerns a symmetric/asymmetric key confusion attack. In PyJWT, the invalid strings check in HMACAlgorithm.prepare key does not account for all PEM encoded public keys, specifically the PKCS1 PEM encoded format. This allows an attacker to craft JWTs from scratch when using the PKCS1 PEM encoded public keys.

Recommendations For PyJWT versions 1.5.0 and below, consider updating to a version above 1.5.0 to resolve the issue. As a temporary workaround, restrict the use of PKCS1 PEM encoded public keys to minimize the risk of exploitation. Avoid using the HMACAlgorithm.prepare key function with PKCS1 PEM encoded public keys until the issue is resolved.

Correção

Identificadores relacionados

CVE-2017-11424

DSA-3979-1

GHSA-R9JW-MWHQ-WP62

PYSEC-2017-24

USN-3407-1

Produtos afetados

Pyjwt

Ubuntu

Referências · 17

• https://github.com/jpadilla/pyjwt · Nota
• https://github.com/jpadilla/pyjwt/pull/277 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2017-24.yaml · Nota
• http://debian.org/security/2017/dsa-3979 · Aviso do Fabricante
• https://github.com/advisories/GHSA-r9jw-mwhq-wp62 · Nota
• https://cve.org/CVERecord?id=CVE-2017-11424 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-11424 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11424 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11424 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3979-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3407-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11424 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r9jw-mwhq-wp62 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11424 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-24 · Aviso do Fabricante