Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[GHSA-5357-c2jx-v7qh] Authlib has algorithm confusion with asymmetric public keys #5262

Open
wants to merge 1 commit into
base: m3t3kh4n/advisory-improvement-5262
Choose a base branch
from
Open

[GHSA-5357-c2jx-v7qh] Authlib has algorithm confusion with asymmetric public keys #5262

wants to merge 1 commit into from

Conversation

m3t3kh4n
Copy link

Updates

  • Affected products

Comments

  • Added another pypi package - joserfc which is affected by the same vulnerability.

@github-actions github-actions bot changed the base branch from main to m3t3kh4n/advisory-improvement-5262 February 11, 2025 20:36
@JonathanLEvans
Copy link

Hi @m3t3kh4n, how did you determine that joserfc is affected?

@m3t3kh4n
Copy link
Author

Hey @JonathanLEvans , they have mentioned it in the given issue: authlib/joserfc#27. Also, it is available in their CHANGELOG: https://jose.authlib.org/en/changelog/#id6

@JonathanLEvans
Copy link

Do lepture Authlib and authlib/joserfc share code? If they don't, then authlib/joserfc needs its own CVE.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@m3t3kh4n @JonathanLEvans