PT-2024-40234 · Pypi+1 · Pyjwt+1
Published
2024-02-09
·
Updated
2024-02-09
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
vng-api-common versions prior to 1.12.2
Description:
This issue is related to a privilege escalation vulnerability, although its impact is negligible and entirely theoretical. It involves the verification of client-supplied JSON Web Tokens (JWTs) and how the PyJWT library handles user-supplied algorithms. The vulnerability could potentially allow an attacker to tamper with client JWTs, resulting in privilege escalation and impersonation of any client without leaving a trace. However, due to the use of an explicit allow-list of known algorithms in the PyJWT library, user-supplied invalid algorithms are rejected, making this vulnerability non-exploitable.
Recommendations:
For versions prior to 1.12.2, update to version 1.12.2 to resolve the issue.
As a temporary workaround, consider checking that the used PyJWT has no algorithms specified with a name in "", "HS25", "HS2", "HS", "H", or ensure that those algorithms are acceptable.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pyjwt
Vng-Api-Common