CVE-2024-53861: PyJWT PyJWT Issuer Field Partial Matches Vulnerability

LOW
Advisory Identifier: GHSA-75c5-xw7c-p5pm
Share
CVSS 2.2
CWE-697
Published
Advisory Summary

CVE-2024-53861 is a LOW (CVSS 2.2) pyjwt issuer field partial matches vulnerability (CWE-697: Incorrect Comparison) affecting PyJWT libraries in the PyPI ecosystem. The issue involves pyjwt issuer field partial matches allowed. Remediation is available by upgrading affected packages to version 2.10.1.

CVE-2024-53861 at a Glance

CVE Identifier CVE-2024-53861
GHSA Identifier GHSA-75c5-xw7c-p5pm
Severity LOW
CVSS v3.1 Base Score 2.2
CWE Classification CWE-697: Incorrect Comparison
Affected Product PyJWT
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 2.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required High (PR:H)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2024-53861

To remediate this vulnerability, upgrade all affected PyJWT dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

PyJWT fixed: 2.10.1 
pip install PyJWT>=2.10.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show PyJWT

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2024-53861, inspect your installed packages using pip:

pip show PyJWT

Analyze the terminal output to locate any version of PyJWT in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.10.1), your application is affected.

Note: The pip show PyJWT command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-697: Incorrect Comparison, where the product compares two entities in a security-relevant context, but the comparison is incorrect. In PyJWT, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The wrong string if check is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. ### Details This is a bug introduced in version [2.10.0](https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366): checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. ```diff - if isinstance(issuer, list): + if isinstance(issuer, Sequence): if payload["iss"] not in issuer: raise InvalidIssuerError("Invalid issuer") else: ``` Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. ### PoC Check out the unit tests added here: https://github.com/jpadilla/pyjwt-ghsa-75c5-xw7c-p5pm ```python issuer = "urn:expected" payload = {"iss": "urn:"} token = jwt.encode(payload, "secret") # decode() succeeds, even though `"urn:" != "urn:expected". No exception is raised. with pytest.raises(InvalidIssuerError): jwt.decode(token, "secret", issuer=issuer, algorithms=["HS256"]) ``` ### Impact I would say the real world impact is not that high, seeing as the signature still has to match. We should still fix it.

CVE-2024-53861 Affected PyJWT Versions

1 component(s)
Fixed Versions:
2.10.1
Product / Package Ecosystem Affected Versions Fixed Version
PyJWT
pypi/PyJWT
PyPI
≥ 2.10.0
< 2.10.1
All 1 versions
2.10.0
2.10.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm
NVD — CVE-2024-53861 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-53861
Security Fix Commit FIX COMMIT
https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366
Security Fix Commit FIX COMMIT
https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1
PyJWT Source Repository REPOSITORY
https://github.com/jpadilla/pyjwt

Frequently Asked Questions

What is CVE-2024-53861?
CVE-2024-53861 is a security vulnerability in PyJWT involving PyJWT Issuer field partial matches allowed under CWE-697: Incorrect Comparison.
Which PyJWT versions are affected?
Affected versions include releases prior to 2.10.1 across affected packages: PyJWT.
What version fixes CVE-2024-53861?
Upgrading to 2.10.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is PyJWT affected?
Yes, PyJWT is affected in releases prior to 2.10.1. Upgrade your dependency to 2.10.1 or later.
What is the CVSS score of CVE-2024-53861?
CVE-2024-53861 has a CVSS v3.1 base score of 2.2 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N.
What CWE is associated with CVE-2024-53861?
CVE-2024-53861 is classified under CWE-697: Incorrect Comparison (The product compares two entities in a security-relevant context, but the comparison is incorrect.).
How can I check PyPI dependencies for CVE-2024-53861?
Run the dependency tree command: 'pip show PyJWT'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-75c5-xw7c-p5pm",
  "modified" : "2024-12-02T18:34:11Z",
  "published" : "2024-12-02T18:34:11Z",
  "aliases" : [ "CVE-2024-53861" ],
  "summary" : "PyJWT Issuer field partial matches allowed",
  "details" : "### Summary\nThe wrong string if check is run for `iss` checking, resulting in `\"acb\"` being accepted for `\"_abc_\"`.\n\n### Details\nThis is a bug introduced in version [2.10.0](https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366): checking the \"iss\" claim\nchanged from `isinstance(issuer, list)` to `isinstance(issuer,\nSequence)`.\n\n```diff\n-        if isinstance(issuer, list):\n+        if isinstance(issuer, Sequence):\n            if payload[\"iss\"] not in issuer:\n                raise InvalidIssuerError(\"Invalid issuer\")\n        else:\n```\n\nSince str is a Sequnce, but not a list, `in` is also used for string\ncomparison. This results in `if \"abc\" not in \"__abcd__\":` being\nchecked instead of `if \"abc\" != \"__abc__\":`.\n### PoC\nCheck out the unit tests added here: https://github.com/jpadilla/pyjwt-ghsa-75c5-xw7c-p5pm\n```python\n        issuer = \"urn:expected\"\n\n        payload = {\"iss\": \"urn:\"}\n\n        token = jwt.encode(payload, \"secret\")\n\n        # decode() succeeds, even though `\"urn:\" != \"urn:expected\". No exception is raised.\n        with pytest.raises(InvalidIssuerError):\n            jwt.decode(token, \"secret\", issuer=issuer, algorithms=[\"HS256\"])\n```\n\n\n### Impact\n\nI would say the real world impact is not that high, seeing as the signature still has to match. We should still fix it.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "PyJWT"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.10.0"
      }, {
        "fixed" : "2.10.1"
      } ]
    } ],
    "versions" : [ "2.10.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-53861"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jpadilla/pyjwt"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-697" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-12-02T18:34:11Z",
    "nvd_published_at" : "2024-11-29T19:15:09Z"
  }
}