CVE-2022-29217

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-29217
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29217.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29217
Aliases
Downstream
Related
Published
2022-05-24T14:10:10Z
Modified
2026-02-15T08:06:39.007915Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Key confusion through non-blocklisted public key formats in PyJWT
Details

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify jwt.algorithms.get_default_algorithms() to get support for all algorithms, or specify a single algorithm. The issue is not that big as algorithms=jwt.algorithms.get_default_algorithms() has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding.

Database specific 
{
    "cwe_ids": [
        "CWE-327"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29217.json"
}
References

Affected packages

Git / github.com/jpadilla/pyjwt

Affected ranges

Type
GIT
Repo
https://github.com/jpadilla/pyjwt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
83ff831a4d11190e3a0bed781da43f8d84352653
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9c528670c455b8d948aff95ed50e22940d1ad3fc
Introduced
908ee84aeefb8126a94e48e88ba9916d9d2512b3
Fixed
83ff831a4d11190e3a0bed781da43f8d84352653

Affected versions

1.*
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.3
1.6.4
1.7.0
1.7.1
2.*
2.0.0
2.0.0a1
2.0.0a2
2.0.1
2.1.0
2.2.0
2.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29217.json"

Git / gitlab.com/wireshark/wireshark

Affected ranges

Type
GIT
Repo
https://gitlab.com/wireshark/wireshark
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9be0fa500da594ed01baf3214642838d22811c90

Affected versions

Other
backups/ethereal@18706
ethereal-0-3-15
start
ethereal-0.*
ethereal-0.3.15
v1.*
v1.11.0
v1.11.0-rc1
v1.11.1
v1.11.1-rc1
v1.11.2
v1.11.2-rc1
v1.11.3
v1.11.3-rc1
v1.11.4-rc1
v1.99.0
v1.99.0-rc1
v1.99.1
v1.99.10rc0
v1.99.1rc0
v1.99.2
v1.99.2rc0
v1.99.3
v1.99.3rc0
v1.99.4
v1.99.4rc0
v1.99.5
v1.99.5rc0
v1.99.6
v1.99.6rc0
v1.99.7
v1.99.7rc0
v1.99.8
v1.99.8rc0
v1.99.9
v1.99.9rc0
v2.*
v2.1.0
v2.1.0rc0
v2.1.1
v2.1.1rc0
v2.1.2rc0
v2.3.0rc0
v2.4.0rc0
v2.4.0rc1
v2.4.0rc2
wireshark-1.*
wireshark-1.11.3
wireshark-1.99.0
wireshark-1.99.1
wireshark-1.99.2
wireshark-1.99.3
wireshark-1.99.4
wireshark-1.99.5
wireshark-1.99.6
wireshark-1.99.7
wireshark-1.99.8
wireshark-1.99.9
wireshark-2.*
wireshark-2.1.0
wireshark-2.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29217.json"