python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.
References
Link | Resource |
---|---|
https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9 | Patch |
https://github.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fp | Patch Third Party Advisory |
https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yaml | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-09-23T06:55:09
Updated: 2024-07-10T20:53:34.449Z
Reserved: 2022-09-02T00:00:00
Link: CVE-2022-39227
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-09-23T07:15:09.300
Modified: 2023-03-04T01:43:06.280
Link: CVE-2022-39227
JSON object: View
Redhat Information
No data.
CWE