Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:1199-1

Опубликовано: 07 апр. 2026
Источник: suse-cvrf

Описание

Security update for python-PyJWT

This update for python-PyJWT fixes the following issues:

  • CVE-2026-32597: Fixed unknown crit header extensions accepts (bsc#1259616).

Список пакетов

Image SLES12-SP5-Azure-BYOS
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-HPC-BYOS
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-HPC-On-Demand
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-SAP-BYOS
python-PyJWT-1.5.3-3.19.1
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-SAP-On-Demand
python-PyJWT-1.5.3-3.19.1
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-Standard-On-Demand
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-EC2-BYOS
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-EC2-ECS-On-Demand
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-EC2-On-Demand
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-EC2-SAP-BYOS
python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-EC2-SAP-On-Demand
python3-PyJWT-1.5.3-3.19.1
SUSE Linux Enterprise Module for Public Cloud 12
python-PyJWT-1.5.3-3.19.1
python3-PyJWT-1.5.3-3.19.1

Ссылки

Описание

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-HPC-BYOS:python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-HPC-On-Demand:python3-PyJWT-1.5.3-3.19.1
Image SLES12-SP5-Azure-SAP-BYOS:python-PyJWT-1.5.3-3.19.1
Ссылки