Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/pyjwt@1.7.0-2
purl pkg:deb/debian/pyjwt@1.7.0-2
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-42yf-7k7m-dkf6 In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch. CVE-2017-11424
GHSA-r9jw-mwhq-wp62
PYSEC-2017-24

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-04T00:06:16.456555+00:00 Debian Oval Importer Fixing VCID-42yf-7k7m-dkf6 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0
2026-04-15T23:27:32.642915+00:00 Debian Oval Importer Fixing VCID-42yf-7k7m-dkf6 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.4.0
2026-04-11T23:02:54.726309+00:00 Debian Oval Importer Fixing VCID-42yf-7k7m-dkf6 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.3.0
2026-04-08T22:36:48.724491+00:00 Debian Oval Importer Fixing VCID-42yf-7k7m-dkf6 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.1.0