Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PyJWT 安全漏洞
Vulnerability Description
Python是Python软件基金会的一套开源的、面向对象的程序设计语言。PyJWT是软件开发者Jose Padilla所研发的一个Python中的JSON Web Token实现。 PyJWT 1.5.0及之前的版本中存在安全漏洞。攻击者可利用该漏洞制造JWT。
CVSS Information
N/A
Vulnerability Type
N/A