PT-2017-12006 · Python+1 · Pyjwt+1

Jpadilla · Published 2017-08-24 · Updated 2022-05-13 · CVE-2017-11424

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PyJWT versions 1.5.0 and below

Description The issue concerns a symmetric/asymmetric key confusion attack. In PyJWT, the invalid strings check in HMACAlgorithm.prepare key does not account for all PEM encoded public keys, specifically the PKCS1 PEM encoded format. This allows an attacker to craft JWTs from scratch when using the PKCS1 PEM encoded public keys.

Recommendations For PyJWT versions 1.5.0 and below, consider updating to a version above 1.5.0 to resolve the issue. As a temporary workaround, restrict the use of PKCS1 PEM encoded public keys to minimize the risk of exploitation. Avoid using the HMACAlgorithm.prepare key function with PKCS1 PEM encoded public keys until the issue is resolved.

Fix

Related Identifiers

CVE-2017-11424

DSA-3979-1

GHSA-R9JW-MWHQ-WP62

PYSEC-2017-24

USN-3407-1

Affected Products

Pyjwt

Ubuntu

References · 17

• https://github.com/jpadilla/pyjwt/pull/277 · Patch
• http://debian.org/security/2017/dsa-3979 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11424 · Security Note
• https://ubuntu.com/security/CVE-2017-11424 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11424 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11424 · Security Note
• https://osv.dev/vulnerability/DSA-3979-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3407-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11424 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r9jw-mwhq-wp62 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11424 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-24 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-11424 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3407-1 · Vendor Advisory
• https://github.com/jpadilla/pyjwt · Note