Red Hat Satellite 6/satellite:el8/python-pyjwt
Red Hat · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys | pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 | PyPIRed Hat | Medium | Fix reported | |
| PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS | pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 | PyPIRed Hat | Medium | Fix reported | |
| PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes | pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 | PyPIRed Hat | Medium | Fix reported | |
| PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) | pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 | PyPIRed Hat | Low | Fix reported |