GoogleCloudPlatform / getting-started-python

Code samples for using Python on Google Cloud Platform
https://cloud.google.com/python
Apache License 2.0
787 stars 590 forks source link

Replace python-jose dependency #565

Open Jipje opened 6 months ago

Jipje commented 6 months ago

A vulnerability has been found in the ecdsa dependency which will not be patched in the python-jose package. python-jose seems to be abandoned. Other people are also encountering these security issues.

I suggest to update authenticating-users/main.py to not use this insecure package. A commonly used alternative is PyJWT.

Jipje commented 6 months ago

Further searching also shows that GoogleCloudPlatform/python-docs-samples/iap/validate_jwt.py could contain a potential solution

vchudnov-g commented 5 months ago

Thanks for reporting this issue! We'll address it promptly.