Skip to content
This repository was archived by the owner on Nov 13, 2023. It is now read-only.

Commit 88ad9e6

Browse files
davedoesdevdavedoesdev
committed
FIX VULNERABILITY
jwcrypto accepts both compact and JSON formats. It was possible to use this to present a token with arbitrary claims with a signature from another valid token. See test/vulnerability_vows.py for an example.
1 parent 33d93e4 commit 88ad9e6

15 files changed

+153
-94
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
Module for generating and verifying [JSON Web Tokens](http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html).
44

5+
- **Note:** Versions 3.3.4 and later fix a vulnerability in JSON Web Token verification which lets an attacker with a valid token to re-use its signature with modified claims. CVE to follow. Please upgrade!
56
- **Note:** From version 2.0.1 the namespace has changed from `jwt` to `python_jwt`, in order to avoid conflict with [PyJWT](https://github.com/jpadilla/pyjwt).
67
- **Note:** Versions 1.0.0 and later fix [a vulnerability](https://www.timmclean.net/2015/02/25/jwt-alg-none.html) in JSON Web Token verification so please upgrade if you're using this functionality. The API has changed so you will need to update your application. [verify_jwt](http://rawgit.davedoesdev.com/davedoesdev/python-jwt/master/docs/_build/html/index.html#python_jwt.verify_jwt) now requires you to specify which signature algorithms are allowed.
78
- Uses [jwcrypto](https://jwcrypto.readthedocs.io) to do the heavy lifting.

‎coverage/coverage.xml

+75-67
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?xml version="1.0" ?>
2-
<coverage version="6.4.1" timestamp="1656832390379" lines-valid="88" lines-covered="88" line-rate="1" branches-valid="58" branches-covered="58" branch-rate="1" complexity="0">
2+
<coverage version="6.4.1" timestamp="1661973013420" lines-valid="96" lines-covered="96" line-rate="1" branches-valid="60" branches-covered="60" branch-rate="1" complexity="0">
33
<!-- Generated by coverage.py: https://coverage.readthedocs.io -->
44
<!-- Based on https://raw.githubusercontent.com/cobertura/web/master/htdocs/xml/coverage-04.dtd -->
55
<sources>
@@ -16,89 +16,97 @@
1616
<line number="7" hits="1"/>
1717
<line number="8" hits="1"/>
1818
<line number="9" hits="1"/>
19-
<line number="12" hits="1" branch="true" condition-coverage="100% (2/2)"/>
20-
<line number="15" hits="1"/>
21-
<line number="17" hits="1"/>
22-
<line number="59" hits="1"/>
23-
<line number="64" hits="1" branch="true" condition-coverage="100% (2/2)"/>
24-
<line number="65" hits="1"/>
25-
<line number="66" hits="1" branch="true" condition-coverage="100% (2/2)"/>
26-
<line number="67" hits="1"/>
19+
<line number="10" hits="1"/>
20+
<line number="13" hits="1" branch="true" condition-coverage="100% (2/2)"/>
21+
<line number="16" hits="1"/>
22+
<line number="18" hits="1"/>
23+
<line number="60" hits="1"/>
24+
<line number="65" hits="1" branch="true" condition-coverage="100% (2/2)"/>
25+
<line number="66" hits="1"/>
26+
<line number="67" hits="1" branch="true" condition-coverage="100% (2/2)"/>
2727
<line number="68" hits="1"/>
28-
<line number="70" hits="1"/>
29-
<line number="72" hits="1"/>
30-
<line number="74" hits="1" branch="true" condition-coverage="100% (2/2)"/>
31-
<line number="75" hits="1"/>
32-
<line number="77" hits="1"/>
28+
<line number="69" hits="1"/>
29+
<line number="71" hits="1"/>
30+
<line number="73" hits="1"/>
31+
<line number="75" hits="1" branch="true" condition-coverage="100% (2/2)"/>
32+
<line number="76" hits="1"/>
3333
<line number="78" hits="1"/>
34-
<line number="80" hits="1" branch="true" condition-coverage="100% (2/2)"/>
35-
<line number="81" hits="1"/>
36-
<line number="82" hits="1" branch="true" condition-coverage="100% (2/2)"/>
37-
<line number="83" hits="1"/>
38-
<line number="85" hits="1" branch="true" condition-coverage="100% (2/2)"/>
39-
<line number="86" hits="1"/>
40-
<line number="88" hits="1"/>
34+
<line number="79" hits="1"/>
35+
<line number="81" hits="1" branch="true" condition-coverage="100% (2/2)"/>
36+
<line number="82" hits="1"/>
37+
<line number="83" hits="1" branch="true" condition-coverage="100% (2/2)"/>
38+
<line number="84" hits="1"/>
39+
<line number="86" hits="1" branch="true" condition-coverage="100% (2/2)"/>
40+
<line number="87" hits="1"/>
4141
<line number="89" hits="1"/>
4242
<line number="90" hits="1"/>
4343
<line number="91" hits="1"/>
44-
<line number="93" hits="1"/>
45-
<line number="101" hits="1"/>
46-
<line number="142" hits="1" branch="true" condition-coverage="100% (2/2)"/>
47-
<line number="143" hits="1"/>
48-
<line number="145" hits="1" branch="true" condition-coverage="100% (2/2)"/>
49-
<line number="147" hits="1"/>
50-
<line number="149" hits="1"/>
51-
<line number="151" hits="1"/>
44+
<line number="92" hits="1"/>
45+
<line number="94" hits="1"/>
46+
<line number="102" hits="1"/>
47+
<line number="103" hits="1"/>
48+
<line number="104" hits="1" branch="true" condition-coverage="100% (2/2)"/>
49+
<line number="105" hits="1"/>
50+
<line number="107" hits="1"/>
51+
<line number="150" hits="1"/>
52+
<line number="152" hits="1" branch="true" condition-coverage="100% (2/2)"/>
5253
<line number="153" hits="1"/>
53-
<line number="154" hits="1" branch="true" condition-coverage="100% (2/2)"/>
54-
<line number="155" hits="1"/>
55-
<line number="156" hits="1" branch="true" condition-coverage="100% (2/2)"/>
54+
<line number="155" hits="1" branch="true" condition-coverage="100% (2/2)"/>
5655
<line number="157" hits="1"/>
57-
<line number="159" hits="1" branch="true" condition-coverage="100% (2/2)"/>
58-
<line number="160" hits="1" branch="true" condition-coverage="100% (2/2)"/>
59-
<line number="161" hits="1" branch="true" condition-coverage="100% (2/2)"/>
60-
<line number="162" hits="1"/>
61-
<line number="163" hits="1" branch="true" condition-coverage="100% (2/2)"/>
62-
<line number="164" hits="1"/>
56+
<line number="159" hits="1"/>
57+
<line number="161" hits="1"/>
58+
<line number="163" hits="1"/>
59+
<line number="164" hits="1" branch="true" condition-coverage="100% (2/2)"/>
60+
<line number="165" hits="1"/>
6361
<line number="166" hits="1" branch="true" condition-coverage="100% (2/2)"/>
6462
<line number="167" hits="1"/>
65-
<line number="168" hits="1"/>
66-
<line number="169" hits="1"/>
63+
<line number="169" hits="1" branch="true" condition-coverage="100% (2/2)"/>
6764
<line number="170" hits="1" branch="true" condition-coverage="100% (2/2)"/>
68-
<line number="171" hits="1"/>
69-
<line number="173" hits="1"/>
70-
<line number="175" hits="1"/>
71-
<line number="176" hits="1"/>
65+
<line number="171" hits="1" branch="true" condition-coverage="100% (2/2)"/>
66+
<line number="172" hits="1"/>
67+
<line number="173" hits="1" branch="true" condition-coverage="100% (2/2)"/>
68+
<line number="174" hits="1"/>
69+
<line number="176" hits="1" branch="true" condition-coverage="100% (2/2)"/>
70+
<line number="177" hits="1"/>
7271
<line number="178" hits="1"/>
73-
<line number="179" hits="1" branch="true" condition-coverage="100% (2/2)"/>
74-
<line number="180" hits="1" branch="true" condition-coverage="100% (2/2)"/>
75-
<line number="181" hits="1"/>
76-
<line number="182" hits="1" branch="true" condition-coverage="100% (2/2)"/>
77-
<line number="183" hits="1"/>
78-
<line number="185" hits="1"/>
79-
<line number="186" hits="1" branch="true" condition-coverage="100% (2/2)"/>
80-
<line number="187" hits="1" branch="true" condition-coverage="100% (2/2)"/>
81-
<line number="188" hits="1"/>
82-
<line number="189" hits="1" branch="true" condition-coverage="100% (2/2)"/>
83-
<line number="190" hits="1"/>
72+
<line number="179" hits="1"/>
73+
<line number="180" hits="1"/>
74+
<line number="181" hits="1" branch="true" condition-coverage="100% (2/2)"/>
75+
<line number="182" hits="1"/>
76+
<line number="184" hits="1"/>
77+
<line number="186" hits="1"/>
78+
<line number="187" hits="1"/>
79+
<line number="189" hits="1"/>
80+
<line number="190" hits="1" branch="true" condition-coverage="100% (2/2)"/>
81+
<line number="191" hits="1" branch="true" condition-coverage="100% (2/2)"/>
8482
<line number="192" hits="1"/>
8583
<line number="193" hits="1" branch="true" condition-coverage="100% (2/2)"/>
86-
<line number="194" hits="1" branch="true" condition-coverage="100% (2/2)"/>
87-
<line number="195" hits="1"/>
88-
<line number="196" hits="1" branch="true" condition-coverage="100% (2/2)"/>
89-
<line number="197" hits="1"/>
84+
<line number="194" hits="1"/>
85+
<line number="196" hits="1"/>
86+
<line number="197" hits="1" branch="true" condition-coverage="100% (2/2)"/>
87+
<line number="198" hits="1" branch="true" condition-coverage="100% (2/2)"/>
9088
<line number="199" hits="1"/>
9189
<line number="200" hits="1" branch="true" condition-coverage="100% (2/2)"/>
92-
<line number="201" hits="1" branch="true" condition-coverage="100% (2/2)"/>
93-
<line number="202" hits="1"/>
94-
<line number="203" hits="1" branch="true" condition-coverage="100% (2/2)"/>
95-
<line number="204" hits="1"/>
90+
<line number="201" hits="1"/>
91+
<line number="203" hits="1"/>
92+
<line number="204" hits="1" branch="true" condition-coverage="100% (2/2)"/>
93+
<line number="205" hits="1" branch="true" condition-coverage="100% (2/2)"/>
9694
<line number="206" hits="1"/>
95+
<line number="207" hits="1" branch="true" condition-coverage="100% (2/2)"/>
96+
<line number="208" hits="1"/>
9797
<line number="210" hits="1"/>
98-
<line number="222" hits="1"/>
99-
<line number="223" hits="1"/>
100-
<line number="224" hits="1"/>
101-
<line number="225" hits="1"/>
98+
<line number="211" hits="1" branch="true" condition-coverage="100% (2/2)"/>
99+
<line number="212" hits="1" branch="true" condition-coverage="100% (2/2)"/>
100+
<line number="213" hits="1"/>
101+
<line number="214" hits="1" branch="true" condition-coverage="100% (2/2)"/>
102+
<line number="215" hits="1"/>
103+
<line number="217" hits="1"/>
104+
<line number="221" hits="1"/>
105+
<line number="233" hits="1"/>
106+
<line number="234" hits="1"/>
107+
<line number="235" hits="1"/>
108+
<line number="236" hits="1"/>
109+
<line number="237" hits="1"/>
102110
</lines>
103111
</class>
104112
</classes>

‎coverage/html/index.html

+8-8
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ <h1>Coverage report:
4747
</form>
4848
<p class="text">
4949
<a class="nav" href="https://coverage.readthedocs.io">coverage.py v6.4.1</a>,
50-
created at 2022-07-03 08:13 +0100
50+
created at 2022-08-31 20:10 +0100
5151
</p>
5252
</div>
5353
</header>
@@ -67,23 +67,23 @@ <h1>Coverage report:
6767
<tbody>
6868
<tr class="file">
6969
<td class="name left"><a href="d_7bfe6de028c7ad70___init___py.html">python_jwt/__init__.py</a></td>
70-
<td>88</td>
70+
<td>96</td>
7171
<td>0</td>
7272
<td>0</td>
73-
<td>58</td>
73+
<td>60</td>
7474
<td>0</td>
75-
<td class="right" data-ratio="146 146">100%</td>
75+
<td class="right" data-ratio="156 156">100%</td>
7676
</tr>
7777
</tbody>
7878
<tfoot>
7979
<tr class="total">
8080
<td class="name left">Total</td>
81-
<td>88</td>
81+
<td>96</td>
8282
<td>0</td>
8383
<td>0</td>
84-
<td>58</td>
84+
<td>60</td>
8585
<td>0</td>
86-
<td class="right" data-ratio="146 146">100%</td>
86+
<td class="right" data-ratio="156 156">100%</td>
8787
</tr>
8888
</tfoot>
8989
</table>
@@ -95,7 +95,7 @@ <h1>Coverage report:
9595
<div class="content">
9696
<p>
9797
<a class="nav" href="https://coverage.readthedocs.io">coverage.py v6.4.1</a>,
98-
created at 2022-07-03 08:13 +0100
98+
created at 2022-08-31 20:10 +0100
9999
</p>
100100
</div>
101101
<aside class="hidden">

‎coverage/html/status.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"format":2,"version":"6.4.1","globals":"808b5cd956a194fa2027f5f6eb2aaf06","files":{"d_7bfe6de028c7ad70___init___py":{"hash":"eee4edc908a3614db375ba99356b09c0","index":{"nums":[0,1,88,0,0,58,0,0],"html_filename":"d_7bfe6de028c7ad70___init___py.html","relative_filename":"python_jwt/__init__.py"}}}}
1+
{"format":2,"version":"6.4.1","globals":"808b5cd956a194fa2027f5f6eb2aaf06","files":{"d_7bfe6de028c7ad70___init___py":{"hash":"a3460828b320d5b58e5d56aeda5982f0","index":{"nums":[0,1,96,0,0,60,0,0],"html_filename":"d_7bfe6de028c7ad70___init___py.html","relative_filename":"python_jwt/__init__.py"}}}}

‎docs/_build/doctrees/environment.pickle

0 Bytes
Binary file not shown.

‎docs/_build/html/.buildinfo

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
# Sphinx build info version 1
22
# This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done.
3-
config: e1ca4cbd0b61431a5536cbdf2d794e81
3+
config: 0bdc22a8bc7fdc3e0b3b52be398c1405
44
tags: 645f666f9bcd5a90fca523b33c5a78b7

‎docs/_build/html/_static/documentation_options.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
var DOCUMENTATION_OPTIONS = {
22
URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'),
3-
VERSION: '3.3.3',
3+
VERSION: '3.3.4',
44
LANGUAGE: 'None',
55
COLLAPSE_INDEX: false,
66
BUILDER: 'html',

‎docs/_build/html/genindex.html

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<head>
66
<meta charset="utf-8" />
77
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
8-
<title>Index &#8212; python-jwt 3.3.3 documentation</title>
8+
<title>Index &#8212; python-jwt 3.3.4 documentation</title>
99
<link rel="stylesheet" type="text/css" href="_static/pygments.css" />
1010
<link rel="stylesheet" type="text/css" href="_static/nature.css" />
1111
<script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
@@ -24,7 +24,7 @@ <h3>Navigation</h3>
2424
<li class="right" >
2525
<a href="py-modindex.html" title="Python Module Index"
2626
>modules</a> |</li>
27-
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.3 documentation</a> &#187;</li>
27+
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.4 documentation</a> &#187;</li>
2828
<li class="nav-item nav-item-this"><a href="">Index</a></li>
2929
</ul>
3030
</div>
@@ -121,7 +121,7 @@ <h3>Navigation</h3>
121121
<li class="right" >
122122
<a href="py-modindex.html" title="Python Module Index"
123123
>modules</a> |</li>
124-
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.3 documentation</a> &#187;</li>
124+
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.4 documentation</a> &#187;</li>
125125
<li class="nav-item nav-item-this"><a href="">Index</a></li>
126126
</ul>
127127
</div>

‎docs/_build/html/index.html

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<meta charset="utf-8" />
77
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
88

9-
<title>python_jwt module &#8212; python-jwt 3.3.3 documentation</title>
9+
<title>python_jwt module &#8212; python-jwt 3.3.4 documentation</title>
1010
<link rel="stylesheet" type="text/css" href="_static/pygments.css" />
1111
<link rel="stylesheet" type="text/css" href="_static/nature.css" />
1212
<script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
@@ -25,7 +25,7 @@ <h3>Navigation</h3>
2525
<li class="right" >
2626
<a href="py-modindex.html" title="Python Module Index"
2727
>modules</a> |</li>
28-
<li class="nav-item nav-item-0"><a href="#">python-jwt 3.3.3 documentation</a> &#187;</li>
28+
<li class="nav-item nav-item-0"><a href="#">python-jwt 3.3.4 documentation</a> &#187;</li>
2929
<li class="nav-item nav-item-this"><a href="">python_jwt module</a></li>
3030
</ul>
3131
</div>
@@ -204,7 +204,7 @@ <h3>Navigation</h3>
204204
<li class="right" >
205205
<a href="py-modindex.html" title="Python Module Index"
206206
>modules</a> |</li>
207-
<li class="nav-item nav-item-0"><a href="#">python-jwt 3.3.3 documentation</a> &#187;</li>
207+
<li class="nav-item nav-item-0"><a href="#">python-jwt 3.3.4 documentation</a> &#187;</li>
208208
<li class="nav-item nav-item-this"><a href="">python_jwt module</a></li>
209209
</ul>
210210
</div>

‎docs/_build/html/py-modindex.html

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<head>
66
<meta charset="utf-8" />
77
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
8-
<title>Python Module Index &#8212; python-jwt 3.3.3 documentation</title>
8+
<title>Python Module Index &#8212; python-jwt 3.3.4 documentation</title>
99
<link rel="stylesheet" type="text/css" href="_static/pygments.css" />
1010
<link rel="stylesheet" type="text/css" href="_static/nature.css" />
1111
<script data-url_root="./" id="documentation_options" src="_static/documentation_options.js"></script>
@@ -31,7 +31,7 @@ <h3>Navigation</h3>
3131
<li class="right" >
3232
<a href="#" title="Python Module Index"
3333
>modules</a> |</li>
34-
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.3 documentation</a> &#187;</li>
34+
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.4 documentation</a> &#187;</li>
3535
<li class="nav-item nav-item-this"><a href="">Python Module Index</a></li>
3636
</ul>
3737
</div>
@@ -89,7 +89,7 @@ <h3>Navigation</h3>
8989
<li class="right" >
9090
<a href="#" title="Python Module Index"
9191
>modules</a> |</li>
92-
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.3 documentation</a> &#187;</li>
92+
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.4 documentation</a> &#187;</li>
9393
<li class="nav-item nav-item-this"><a href="">Python Module Index</a></li>
9494
</ul>
9595
</div>

‎docs/_build/html/search.html

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<head>
66
<meta charset="utf-8" />
77
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
8-
<title>Search &#8212; python-jwt 3.3.3 documentation</title>
8+
<title>Search &#8212; python-jwt 3.3.4 documentation</title>
99
<link rel="stylesheet" type="text/css" href="_static/pygments.css" />
1010
<link rel="stylesheet" type="text/css" href="_static/nature.css" />
1111

@@ -30,7 +30,7 @@ <h3>Navigation</h3>
3030
<li class="right" >
3131
<a href="py-modindex.html" title="Python Module Index"
3232
>modules</a> |</li>
33-
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.3 documentation</a> &#187;</li>
33+
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.4 documentation</a> &#187;</li>
3434
<li class="nav-item nav-item-this"><a href="">Search</a></li>
3535
</ul>
3636
</div>
@@ -90,7 +90,7 @@ <h3>Navigation</h3>
9090
<li class="right" >
9191
<a href="py-modindex.html" title="Python Module Index"
9292
>modules</a> |</li>
93-
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.3 documentation</a> &#187;</li>
93+
<li class="nav-item nav-item-0"><a href="index.html">python-jwt 3.3.4 documentation</a> &#187;</li>
9494
<li class="nav-item nav-item-this"><a href="">Search</a></li>
9595
</ul>
9696
</div>

‎docs/conf.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
# The short X.Y version.
5353
version = '3.3'
5454
# The full version, including alpha/beta/rc tags.
55-
release = '3.3.3'
55+
release = '3.3.4'
5656

5757
# The language for content autogenerated by Sphinx. Refer to documentation
5858
# for a list of supported languages.

0 commit comments

Comments
 (0)