PYSEC-2025-183
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-45768
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Description
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · pyjwt | introduced 0, last affected 2.10.1 |
Références
- https://github.com/jpadilla WEB
- https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569 REPORT
- https://github.com/jpadilla/pyjwt PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |