CVE-2022-29217 is a high-severity vulnerability affecting PyJWT, a Python implementation of RFC 7519, and related Fedora projects. The flaw, categorized as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), allows an attacker to choose the JWT signing algorithm if the application broadly supports all default algorithms. This network-exploitable vulnerability has low attack complexity and can lead to high integrity impacts, though confidentiality and availability are not affected. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.5.0, < 2.4.0CPE matchmatch criteria | cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-29217
Jun 14, 2022Key confusion through non-blocklisted public key formats
May 24, 2022python-jwt: Key confusion through non-blocklisted public key formats
May 12, 2022Key confusion through non-blocklisted public key formats in PyJWT
May 10, 2022