Fedora 36 python-jwt 2.4.0: Critical Key Confusion Threat Advisory

A Python implementation of JSON Web Token draft 01. This library provides a

means of representing signed content using JSON data structures, including

claims to be transferred between two parties encoded as digitally signed and

encrypted JSON objects.

Update to 2.4.0 to address CVE-2022-29217.

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24

* Thu May 19 2022 Major Hayden - 2.4.0-1

- Update to 2.4.0 (#2085157)

- Fix CVE-2022-29217 (#2088546)

* Tue Apr 26 2022 Carl George - 2.3.0-3

- Convert to pyproject macros

[ 1 ] Bug #2085157 - python-jwt-2.4.0 is available

https://bugzilla.redhat.com/show_bug.cgi?id=2085157

[ 2 ] Bug #2088546 - CVE-2022-29217 python-jwt: Key confusion through non-blocklisted public key formats [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2088546

su -c 'dnf upgrade --advisory FEDORA-2022-3cf456dc20' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/

Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure