Fix CVE-2024-33663 #349
Open
Fix CVE-2024-33663 #349
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I recommend throwing an exception if algorithms is None, rather than setting to ALL. Not specifying the algorithms field is the source of algorithm confusion issues. |
smittysmee
reviewed
May 2, 2024
smittysmee
reviewed
May 2, 2024
smittysmee
reviewed
May 2, 2024
jose/jwt.py
Outdated
| @@ -141,6 +141,9 @@ def decode(token, key, algorithms=None, options=None, audience=None, issuer=None | |||
|
|
|||
| verify_signature = defaults.get("verify_signature", True) | |||
|
|
|||
| if algorithms is None: | |||
| algorithms = ALGORITHMS.ALL | |||
There was a problem hiding this comment.
Why specify? Inline comment & exception would be helpful here. Don't know if there will be downstream impacts:
the algorithms field in jwt.decode is not mandatory, allowing developers to shoot themselves in the foot
inadequate protections in the cryptography backend allowing for HMAC verification with an asymmetric public key
smittysmee
approved these changes
May 2, 2024
bmwiedemann
pushed a commit
to bmwiedemann/openSUSE
that referenced
this pull request
May 6, 2024
https://build.opensuse.org/request/show/1172135 by user dgarcia + anag+factory - Add upstream patches: * CVE-2024-33663.patch, bsc#1223417, gh#mpdavis/python-jose#349 * CVE-2024-33664.patch, bsc#1223422, gh#mpdavis/python-jose#345 * fix-tests-ecdsa-019.patch, gh#mpdavis/python-jose#350
|
Can you rebase your changes onto the latest Would you mind collapsing your commits to a single commit as well? |
This change should fix mpdavis#346 security issue. The code is based on pyjwt change: jpadilla/pyjwt@9c52867
Done |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#346