kritik
CVE-2022-39227
python-jwt: token forgery with new claims
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, CBL-Mariner. Daha düşük diyenler: Red Hat (yüksek).
Açıklama
python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| CBL-Mariner 1.0 | python-jwt | 0:2.4.0-2.cm1 |
| CBL-Mariner 2.0 | python-jwt | 0:2.4.0-2.cm2 |
| pip::GitHub Security Advisory pip | python-jwt | 3.3.4 |
| Red Hat | python-jwt, python2-jwt | düzeltme belirtilmemiş |
4 kaynaktaki 5 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| CBL-Mariner 1.0 | python-jwt | 0:2.4.0-2.cm1 |
| CBL-Mariner 2.0 | python-jwt | 0:2.4.0-2.cm2 |
| pip::GitHub Security Advisory pip | python-jwt | 3.3.4 |
| Red Hat | python-jwt | düzeltme belirtilmemiş |
| Red Hat | python2-jwt | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/security/cve/CVE-2022-39227
- https://github.com/davedoesdev/python-jwt
- https://github.com/davedoesdev/python-jwt/commit/6c5075469847b9e8b6e5336077d989d77a4d2bf1
- https://github.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9
- https://github.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fp
- https://github.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2022-39227
- https://www.cve.org/CVERecord?id=CVE-2022-39227