CVE-2022-29217

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.4.0

Description The issue is related to the implementation of JWT in Python PyJWT, where an attacker can exploit the lack of restrictions on certain open key formats. This allows a remote attacker to impact the integrity of data. The PyJWT library supports multiple JWT signing algorithms, and the application must specify which algorithms are supported. If the application uses jwt.algorithms.get default algorithms(), it may be vulnerable to attacks. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 2.4.0, upgrade to v2.4.0 to receive a patch for this issue. As a temporary workaround, always be explicit with the algorithms that are accepted and expected when decoding.