Fix CVE-2024-33663 - Githubissues

mpdavis / python-jose

A JOSE implementation in Python

MIT License

1.55k stars 237 forks source link

Fix CVE-2024-33663 #349

Open danigm opened 6 months ago

danigm commented 6 months ago

https://github.com/mpdavis/python-jose/issues/346

milliesolem commented 6 months ago

I recommend throwing an exception if algorithms is None, rather than setting to ALL. Not specifying the algorithms field is the source of algorithm confusion issues.

CharlesPerrotMinotHCHB commented 6 months ago

Let's try pinging @asherf and @mpdavis

smittysmee commented 6 months ago

@mpdavis @asherf following up on this

twwildey commented 5 months ago

Can you rebase your changes onto the latest master branch and force-update your branch for this PR?

Would you mind collapsing your commits to a single commit as well?

danigm commented 5 months ago

Can you rebase your changes onto the latest master branch and force-update your branch for this PR?

Would you mind collapsing your commits to a single commit as well?

Done

CharlesPerrotMinotHCHB commented 5 months ago

@twwildey

chrisribe commented 5 months ago

When can we expect an official release for this ?

milliesolem commented 5 months ago

@chrisribe seeing as the library has not seen a release for three years, I wouldn't hold my breath. Switch to PyJWT if you have a project affected by this.

twwildey commented 5 months ago

I believe this GitHub repo has been effectively abandoned in favor of https://authlib.org/. I would recommend everyone migrate their projects to use Authlib directly.