python-jose
https://github.com/mpdavis/python-jose
Python
A JOSE implementation in Python
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
Python not yet supported2 Subscribers
Add a CodeTriage badge to python-jose
Help out
- Issues
- Fix RSA1_5 padding oracle: length-check the unwrapped CEK
- Algorithm-confusion guard bypassed by DER-encoded public keys (incomplete CVE-2024-33663 fix)
- [Security] python-jose ignores the JWS `crit` header (RFC 7515)
- fix: reject tokens missing 'aud' claim when audience is expected
- Use constant-time comparison for the JWE auth tag and the OIDC at_hash claim
- Do not reject present aud claim when audience is None
- Reject JWS tokens declaring unsupported crit header extensions
- [Security] RSA1_5 JWE decryption violates RFC 7516 §11.5: wrong-length unwrapped CEK escapes random-CEK substitution and reaches AES key constructor
- [Security] jwt.decode() with audience= accepts tokens missing 'aud' claim (CWE-287)
- jwt.decode() accepts unsupported critical header extensions
- Docs
- Python not yet supported