Read the docs
TI-2017-08451 Aliases CVE-2017-11424GHSA-r9jw-mwhq-wp62

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.

Why it matters now

EPSS 0.01804 78th percentileScored 2026-11-07
Fix Partial pyjwt (PyPI): 1.5.1Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pyjwt (PyPI)before 1.5.11.5.1Patch availableGHSA-r9jw-mwhq-wp62
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pyjwt (PyPI) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-r9jw-mwhq-wp62

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*up to 1.5.0Vulnerablejpadilla
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:* Versions up to 1.5.0 Vulnerable ·jpadilla
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-r9jw-mwhq-wp62 pyjwt (PyPI) Fixed in 1.5.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11424
  2. 2026-10-03 Alias added: GHSA-r9jw-mwhq-wp62

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences