https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:39:48 +0000 https://vulnerability.circl.lu/vuln/cve-2017-11424 <p>In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.</p> <p>In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.</p> https://vulnerability.circl.lu/vuln/cve-2017-11424 https://vulnerability.circl.lu/vuln/usn-3407-1 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pyjwt</p> <p>It was discovered that a vulnerability in PyJWT doesn&#39;t check invalid_strings properly for some public keys. A remote attacker could take advantage of a key confusion to craft JWTs from scratch.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: pyjwt</p> <p>It was discovered that a vulnerability in PyJWT doesn&#39;t check invalid_strings properly for some public keys. A remote attacker could take advantage of a key confusion to craft JWTs from scratch.</p> https://vulnerability.circl.lu/vuln/usn-3407-1