DailyCVE@dailycve
🔴 PyJWT, Incomplete Asymmetric-Key Guard Bypass, #CVE-2022-29217 (Critical) -DC-Sep2026-2638 https://dailycve.com/pyjwt-incomplete-asymmetric-key-guard-bypass-cve-2022-29217-critical-dc-sep2026-2638/
0000018
238 followersView on X
CVE-2022-29217(fedoraproject / fedora)
LOWCVSS 7.5 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms=jwt.algorithms.get_default_algorithms()` has to be used. Users should upgrade to v2.4.0 to receive a patch for this issue. As a workaround, always be explicit with the algorithms that are accepted and expected when decoding.
0.5/ 10 priority
Sources & remediation
Patch / fix
Vendor / third-party advisories
Other references
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PK7IQCBVNLYJEFTPHBBPFP72H4WUFNX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HIYEYZRQEP6QTHT3EHH3RGFYJIHIMAO/
- https://www.vicarius.io/vsociety/posts/risky-algorithms-algorithm-confusion-in-pyjwt-cve-2022-29217
Weakness type (CWE)
CWE-327
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- fedora
- pyjwt
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Vendors
Products
fedorapyjwt
2 versions affected across 2 products
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
Full discourse1 post
CPE platform detail3 entries
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | fedoraproject | fedora | 35 | - | - |
| OS | fedoraproject | fedora | 36 | - | - |
| App | pyjwt_project | pyjwt | - | - | - |