< back to search

gpp_maybe Security update for python-pyjwt
SUSE-SLE-Micro-5.5-2026-2627

This update for python-PyJWT fixes the following issues - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for SSRF and token forgery (bsc#1266798). - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()` are called with a PyJWK key (bsc#1266799). - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS allows for DoS (bsc#1266801). - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens allows for forged HS256 tokens (bsc#1266802).

cloud_download Downloads

SUSE Linux Enterprise Micro 5.5 s390x
  • Packages
    python-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock src
    python3-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock rpm
SUSE Linux Enterprise Micro 5.5 ppc64le
  • Packages
    python-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock src
    python3-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock rpm
SUSE Linux Enterprise Micro 5.5 aarch64
  • Packages
    python-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock src
    python3-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock rpm
SUSE Linux Enterprise Micro 5.5 x86_64
  • Packages
    python-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock src
    python3-PyJWT
    JSON Web Token implementation in Python
    2.4.0-150200.3.14.1 lock rpm