Fix CVE-2024-33663 #349
Fix CVE-2024-33663 #349
Conversation
|
I recommend throwing an exception if algorithms is None, rather than setting to ALL. Not specifying the algorithms field is the source of algorithm confusion issues. |
jose/jwt.py
Outdated
| @@ -141,6 +141,9 @@ def decode(token, key, algorithms=None, options=None, audience=None, issuer=None | |||
|
|
|||
| verify_signature = defaults.get("verify_signature", True) | |||
|
|
|||
| if algorithms is None: | |||
| algorithms = ALGORITHMS.ALL | |||
There was a problem hiding this comment.
Why specify? Inline comment & exception would be helpful here. Don't know if there will be downstream impacts:
the algorithms field in jwt.decode is not mandatory, allowing developers to shoot themselves in the foot
inadequate protections in the cryptography backend allowing for HMAC verification with an asymmetric public key
https://build.opensuse.org/request/show/1172135 by user dgarcia + anag+factory - Add upstream patches: * CVE-2024-33663.patch, bsc#1223417, gh#mpdavis/python-jose#349 * CVE-2024-33664.patch, bsc#1223422, gh#mpdavis/python-jose#345 * fix-tests-ecdsa-019.patch, gh#mpdavis/python-jose#350
|
Can you rebase your changes onto the latest Would you mind collapsing your commits to a single commit as well? |
This change should fix mpdavis#346 security issue. The code is based on pyjwt change: jpadilla/pyjwt@9c52867
Done |
|
When can we expect an official release for this ? |
|
@chrisribe seeing as the library has not seen a release for three years, I wouldn't hold my breath. Switch to PyJWT if you have a project affected by this. |
|
I believe this GitHub repo has been effectively abandoned in favor of https://authlib.org/. I would recommend everyone migrate their projects to use Authlib directly. |
#346