PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 ยง4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Weakness
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pyjwt | Pyjwt_project | * | 2.12.0 (excluding) |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | automation-controller-0:4.6.28-3.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | python3.12-pyjwt-0:2.12.1-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | automation-controller-0:4.6.28-3.el9ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | python3.12-pyjwt-0:2.12.1-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | automation-controller-0:4.7.11-2.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | python3.12-pyjwt-0:2.12.1-1.el9ap | * |
| Red Hat Enterprise Linux 10 | RedHat | fence-agents-0:4.16.0-13.el10_1.4 | * |
| Red Hat Enterprise Linux 10 | RedHat | fence-agents-0:4.16.0-21.el10_2.1 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | fence-agents-0:4.16.0-5.el10_0.9 | * |
| Red Hat Enterprise Linux 8 | RedHat | fence-agents-0:4.2.1-129.el8_10.25 | * |
| Red Hat Enterprise Linux 9 | RedHat | fence-agents-0:4.10.0-98.el9_7.12 | * |
| Red Hat Enterprise Linux 9 | RedHat | fence-agents-0:4.10.0-110.el9_8.2 | * |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | RedHat | fence-agents-0:4.10.0-43.el9_2.21 | * |
| Red Hat Enterprise Linux 9.4 Extended Update Support | RedHat | fence-agents-0:4.10.0-62.el9_4.24 | * |
| Red Hat Enterprise Linux 9.6 Extended Update Support | RedHat | fence-agents-0:4.10.0-86.el9_6.16 | * |
| Red Hat AI Inference Server 3.3 | RedHat | rhaiis/vllm-cuda-rhel9:1775680192 | * |
| Red Hat AI Inference Server 3.3 | RedHat | rhaiis/vllm-rocm-rhel9:1775680262 | * |
| Red Hat AI Inference Server 3.3 | RedHat | rhaiis/model-opt-cuda-rhel9:1775749857 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/gateway-rhel8:1777394109 | * |
| Red Hat Ansible Automation Platform 2.5 | RedHat | ansible-automation-platform-25/lightspeed-rhel8:1777403872 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/eda-controller-rhel9:1777296732 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/ee-supported-rhel9:1777391447 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/gateway-rhel9:1777311120 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/hub-rhel9:1777299023 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/lightspeed-chatbot-rhel9:1777398576 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/lightspeed-rhel9:1777387242 | * |
| Red Hat Ansible Automation Platform 2.6 | RedHat | ansible-automation-platform-26/mcp-tools-rhel9:1777311601 | * |
| Red Hat Enterprise Linux AI 3.3 | RedHat | rhelai3/bootc-aws-cuda-rhel9:1776871984 | * |
| Red Hat Enterprise Linux AI 3.3 | RedHat | rhelai3/bootc-azure-cuda-rhel9:1776871985 | * |
| Red Hat Enterprise Linux AI 3.3 | RedHat | rhelai3/bootc-azure-rocm-rhel9:1776872005 | * |
| Red Hat Enterprise Linux AI 3.3 | RedHat | rhelai3/bootc-cuda-rhel9:1776773390 | * |
| Red Hat Enterprise Linux AI 3.3 | RedHat | rhelai3/bootc-gcp-cuda-rhel9:1776871987 | * |
| Red Hat Enterprise Linux AI 3.3 | RedHat | rhelai3/bootc-rocm-rhel9:1776773505 | * |
| Red Hat Enterprise Linux AI 3.3 | RedHat | rhelai3/disk-image-cuda-rhel9:1776938871 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-feature-server-rhel9:1776338381 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-kserve-storage-initializer-rhel9:1776343111 | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-vllm-gaudi-rhel9:1780069069 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-vllm-cpu-rhel9:1778264363 | * |
| Red Hat OpenShift AI 3.3 | RedHat | rhoai/odh-vllm-gaudi-rhel9:1778600187 | * |
| Red Hat Quay 3.1 | RedHat | quay/quay-rhel8:1775169155 | * |
| Red Hat Quay 3.12 | RedHat | quay/quay-rhel8:1775253092 | * |
| Red Hat Quay 3.15 | RedHat | quay/quay-rhel8:1775169219 | * |
| Red Hat Quay 3.16 | RedHat | quay/quay-rhel9:1779204086 | * |
| Red Hat Quay 3.9 | RedHat | quay/quay-rhel8:1775169218 | * |
| Red Hat Satellite 6.18 | RedHat | satellite/iop-host-inventory-rhel9:1780414237 | * |
| Red Hat Trusted Artifact Signer 1.4 | RedHat | rhtas/model-transparency-rhel9:1775815407 | * |
| Pyjwt | Ubuntu | esm-infra-legacy/xenial | * |
| Pyjwt | Ubuntu | esm-infra/bionic | * |
| Pyjwt | Ubuntu | esm-infra/focal | * |
| Pyjwt | Ubuntu | esm-infra/xenial | * |
| Pyjwt | Ubuntu | jammy | * |
| Pyjwt | Ubuntu | noble | * |
| Pyjwt | Ubuntu | questing | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/111.html
- https://cwe.mitre.org/data/definitions/141.html
- https://cwe.mitre.org/data/definitions/142.html
- https://cwe.mitre.org/data/definitions/148.html
- https://cwe.mitre.org/data/definitions/218.html
- https://cwe.mitre.org/data/definitions/384.html
- https://cwe.mitre.org/data/definitions/385.html
- https://cwe.mitre.org/data/definitions/386.html
- https://cwe.mitre.org/data/definitions/387.html
- https://cwe.mitre.org/data/definitions/388.html
- https://cwe.mitre.org/data/definitions/665.html
- https://cwe.mitre.org/data/definitions/701.html