PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pyjwt | Pyjwt_project | 2.13.0 (including) | 2.13.0 (including) |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | python3.12-pyjwt-0:2.14.0-1.el9ap | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-rocm-rhel9:1791425869 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-gaudi-rhel9:1791427182 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-cuda-rhel9:1791473631 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-spyre-rhel9:1791818357 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-cpu-rhel9:1791473614 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/ee-supported-rhel9:1791974220 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/gateway-rhel9:1791971533 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-tech-preview/metrics-service-rhel9:1791944819 | * |
| Red Hat Ansible Automation Platform 2.7 | RedHat | ansible-automation-platform-27/gateway-rhel9:1792429216 | * |
| Red Hat Ansible Automation Platform 2.7 | RedHat | ansible-automation-platform-27/metrics-service-rhel9:1792387216 | * |
| Pyjwt | Ubuntu | resolute | * |
| Pyjwt | Ubuntu | stonking | * |
| Pyjwt | Ubuntu | upstream | * |