Описание
Security update for python-jwcrypto
This update for python-jwcrypto fixes the following issues:
- CVE-2026-80179: denial of service via malformed JWE tokens (bsc#1277639).
- CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification (bsc#1278707).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1277639
- SUSE Bug 1278707
- SUSE CVE CVE-2026-80179 page
- SUSE CVE CVE-2026-84185 page
Описание
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Затронутые продукты
Ссылки
- CVE-2026-80179
- SUSE Bug 1277639
Описание
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
Затронутые продукты
Ссылки
- CVE-2026-84185
- SUSE Bug 1278707