p PatchFirst

CVE-2024-37568

CVE-2024-37568

This page contains facts from public vulnerability sources. Check the original advisory before updating.

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)

CVSS 7.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-authlib Debian:12

    Versions
    • 1.2.0-1
    Affected ranges
    • ECOSYSTEM: < 1.2.0-1+deb12u1

    Update to 1.2.0-1+deb12u1

  • python-authlib Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • python-authlib Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • authlib PyPI

    Versions
    • 0.1
    • 0.10
    • 0.11
    • 0.12
    • 0.12.1
    • 0.13
    • 0.14
    • 0.14.1
    • 0.14.2
    • 0.14.3
    • 0.15
    • 0.15.1
    • 0.15.2
    • 0.15.3
    • 0.15.4
    • 0.15.5
    • 0.15.6
    • 0.1rc0
    • 0.2
    • 0.2.1
    • 0.3
    • 0.4
    • 0.4.1
    • 0.5
    • 0.5.1
    • 0.6
    • 0.7
    • 0.8
    • 0.9
    • 1.0.0
    • 1.0.0a1
    • 1.0.0a2
    • 1.0.0b1
    • 1.0.0b2
    • 1.0.0rc1
    • 1.0.1
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.3.0
    Affected ranges
    • ECOSYSTEM: < 1.3.1

    Update to 1.3.1

  • python-authlib Ubuntu:Pro:22.04:LTS

    Versions
    • 0.15.4-1
    • 0.15.5-1
    Affected ranges
    • ECOSYSTEM: < 0.15.5-1ubuntu0.1~esm1

    Update to 0.15.5-1ubuntu0.1~esm1

  • python-authlib Ubuntu:Pro:24.04:LTS

    Versions
    • 1.2.1-1
    • 1.3.0-1
    Affected ranges
    • ECOSYSTEM: < 1.3.0-1ubuntu0.1~esm1

    Update to 1.3.0-1ubuntu0.1~esm1

  • python-authlib Ubuntu:25.10

    Versions
    • 1.5.1-1
    • 1.5.2-1
    • 1.6.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-authlib Ubuntu:26.10

    Versions
    • 1.6.7-1
    • 1.7.2-1
    • 1.7.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-authlib Ubuntu:Pro:26.04:LTS

    Versions
    • 1.6.0-1
    • 1.6.5-1
    • 1.6.6-1
    • 1.6.7-1
    • 1.6.7-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →