CVE-2017-11424

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys

published August 24, 2017

CVSS
—
EPSS
2%
Percentile
78.4
In the wild
Unconfirmed
What it is

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01804 · 78.4th percentile
Published
2017-08-24T16:00Z
EPSS history
Timeline
  • 24 AUG 16:00Z
    In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys
    cvelistv5