Fedora 35 python-jwt 2022-4ae9110f51 Critical: Key Confusion Issue

A Python implementation of JSON Web Token draft 01. This library provides a

means of representing signed content using JSON data structures, including

claims to be transferred between two parties encoded as digitally signed and

encrypted JSON objects.

Update to 2.4.0 to address CVE-2022-29217.

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24

* Thu May 19 2022 Major Hayden - 2.4.0-1

- Update to 2.4.0 (#2085157)

- Fix CVE-2022-29217 (#2088546)

* Tue Apr 26 2022 Carl George - 2.3.0-3

- Convert to pyproject macros

* Fri Jan 21 2022 Fedora Release Engineering - 2.3.0-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

* Tue Oct 26 2021 Joel Capitao - 2.3.0-1

- Update to 2.3.0 (rhbz#2011642)

* Sun Oct 3 2021 Kevin Fenzi - 2.1.0-3

- Relax python-cryptography requirements ( rhbz#2010061 )

[ 1 ] Bug #2085157 - python-jwt-2.4.0 is available

https://bugzilla.redhat.com/show_bug.cgi?id=2085157

[ 2 ] Bug #2088546 - CVE-2022-29217 python-jwt: Key confusion through non-blocklisted public key formats [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2088546

su -c 'dnf upgrade --advisory FEDORA-2022-4ae9110f51' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/

Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure