PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components.
As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Pyjwt_Project Pyjwt
cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*
|
2.1.0
|
2.15.0
|
References 3
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449
https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae633…
https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c
https://github.com/jpadilla/pyjwt/releases/tag/2.15.0
https://github.com/jpadilla/pyjwt/releases/tag/2.15.0