PT-2022-7130 · Pypi+4 · Pyjwt+4
Emmharnuherl
·
Published
2022-05-12
·
Updated
2025-04-11
·
CVE-2022-29217
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
PyJWT versions prior to 2.4.0
Description
The issue is related to the implementation of JWT in Python PyJWT, where an attacker can exploit the lack of restrictions on certain open key formats. This allows a remote attacker to impact the integrity of data. The PyJWT library supports multiple JWT signing algorithms, and the application must specify which algorithms are supported. If the application uses
jwt.algorithms.get default algorithms(), it may be vulnerable to attacks. The estimated number of potentially affected devices is not specified.Recommendations
For versions prior to 2.4.0, upgrade to v2.4.0 to receive a patch for this issue.
As a temporary workaround, always be explicit with the algorithms that are accepted and expected when decoding.
Exploit
Fix
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Pyjwt
Red Os
Suse
Ubuntu