7.5
CVE-2017-11424
- EPSS 1.3%
- Published 24.08.2017 16:29:00
- Last modified 20.04.2025 01:37:25
- Source security@duo.com
- CVE-Watchlists
- Open
LoginIn PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.
Data is provided by the National Vulnerability Database (NVD)
Pyjwt Project ≫ Pyjwt Version <= 1.5.0
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.3% | 0.778 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|