by Kastro
Paper/Archive/CVE-2022-39227

CVE-2022-39227

davedoesdev python-jwt — Python-jwt subject to Authentication Bypass by Spoofing

EPSS 5%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (NVD, CNA agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 92.6.926 × 2018.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.

Affected

ProductAffectedFixed inSource
python-jwt< 3.3.4–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/davedoesdev/python-jwt/security/advisories/GHSA-5p8v-58qm-c7fprefgithub.com/davedoesdev/python-jwt/commit/88ad9e67c53aa5f7c43ec4aa52ed34b7930068c9refgithub.com/pypa/advisory-database/blob/main/vulns/python-jwt/PYSEC-2022-259.yamlrefvicarius.io/vsociety/posts/authentication-bypass-in-python-jwt