Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-102274 →
DEBIAN-CVE-2026-102274
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malform...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
pyjwt
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
pyjwt
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
pyjwt
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-1"}]}]
Références
- advisory security-tracker.debian.org