PT-2022-24825 · Pypi · Python-Jwt

Tom Tervoort · Published 2022-09-01 · Updated 2024-07-10 · CVE-2022-39227

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-jwt versions prior to 3.3.4

Description The issue allows an attacker who obtains a JSON Web Token (JWT) to arbitrarily forge its contents without knowing the secret key. This may enable the attacker to spoof other users' identities, hijack their sessions, or bypass authentication. The vulnerability is caused by an inconsistency between the JWT parsers used by python-jwt and its dependency jwcrypto.

Recommendations For python-jwt versions prior to 3.3.4, upgrade to version 3.3.4 to resolve the issue. As a temporary workaround, consider restricting the use of the verify jwt function until a patch is available. Avoid using the python-jwt module for authentication until the issue is resolved. There are no known workarounds other than upgrading to the fixed version.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

AZL-11032

CVE-2022-39227

GHSA-5P8V-58QM-C7FP

PYSEC-2022-259

Affected Products

Python-Jwt

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39227.json · Exploit
• 🔥 https://github.com/user0x1337/CVE-2022-39227 · Exploit
• https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9 · Patch
• https://github.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fp · Patch
• https://osv.dev/vulnerability/GHSA-5p8v-58qm-c7fp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39227 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39227 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11032 · Vendor Advisory
• https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yaml · Note
• https://github.com/davedoesdev/python-jwt · Note
• https://github.com/davedoesdev/python-jwt/commit/6c5075469847b9e8b6e5336077d989d77a4d2bf1 · Note
• https://twitter.com/PentesterLab/status/1762260894807965724 · Twitter Post
• https://t.me/cibsecurity/50312 · Telegram Post
• https://t.me/cvenotify/36743 · Telegram Post