[GHSA-5357-c2jx-v7qh] Authlib has algorithm confusion with asymmetric public keys

[m3t3kh4n]

Updates

• Affected products

Comments

• Added another pypi package - joserfc which is affected by the same vulnerability.

[JonathanLEvans]

Hi @m3t3kh4n, how did you determine that joserfc is affected?

[m3t3kh4n]

Hey @JonathanLEvans , they have mentioned it in the given issue: authlib/joserfc#27. Also, it is available in their CHANGELOG: https://jose.authlib.org/en/changelog/#id6

[JonathanLEvans]

Do lepture Authlib and authlib/joserfc share code? If they don't, then authlib/joserfc needs its own CVE.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.