Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Replace python-jose #277

Closed
5 tasks done
jpmckinney opened this issue Mar 27, 2024 · 0 comments
Closed
5 tasks done

Replace python-jose #277

jpmckinney opened this issue Mar 27, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@jpmckinney
Copy link
Member

jpmckinney commented Mar 27, 2024 •
edited
Loading

python-jose is not maintained and it depends on ecdsa which has an unresolvable security vulnerability (it would have to be implemented in C, but it's designed to be Python only). See the Reply/Mitigation at GHSA-wj6h-64fc-37mp

We can migrate to https://github.com/jpadilla/pyjwt (jpadilla/pyjwt#942)

We use jose in:

  • jwk.construct
  • base64url_decode
  • jwt.get_unverified_header
  • jwt.get_unverified_claims
  • JWTError
@jpmckinney jpmckinney added the bug Something isn't working label Mar 27, 2024
jpmckinney added a commit that referenced this issue Mar 27, 2024
@jpmckinney
fix: Switch to pyjwt from python-jose #277
68264c0
jpmckinney added a commit that referenced this issue Mar 27, 2024
@jpmckinney
fix: Switch to pyjwt from python-jose #277
a97096c
jpmckinney added a commit that referenced this issue Mar 27, 2024
@jpmckinney
fix: Switch to pyjwt from python-jose #277
47ab499
yolile added a commit that referenced this issue Apr 1, 2024
@yolile
Merge pull request #278 from open-contracting/pyjwt
0fcc5e4 
fix: Switch to pyjwt from python-jose #277
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jpmckinney