zentralopensource / zentral / 36227682781
91%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 1035
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 90.908%. Remained the same
36227682781

push

github

np5 
Bump PyJWT to 2.15.0

Security release. 2.15.0 closes two advisories against 2.14.0.

GHSA-42vr-xj54-vc7v, medium, is reachable here without authentication.
PyJWKClient.get_signing_key_from_jwt decodes the token payload before it
looks up the kid, so before any signature check. On 2.14.0, a payload that is
valid JSON but very deeply nested makes json.loads raise RecursionError, and
RecursionError is not a PyJWTError. zentral.utils.oidc.verify_jws catches
only PyJWTError, so the error escapes. The OIDC API token issuer auth view in
server/accounts/api_views.py is AllowAny and gives the token to verify_jws,
so one forged token of approximately 270 KB gets a 500. 2.15.0 wraps the
error in DecodeError, and the view returns "Invalid token" with a 400.

The new test sends such a token to verify_jws. It fails with RecursionError on
2.14.0 and passes on 2.15.0. It also makes sure that no JWKS fetch occurs. On
Python 3.14, json.loads raises RecursionError only when the C stack is full,
not at a fixed depth. 20,000 levels, the depth in the advisory, parses
without error, and 100,000 levels fills the default 8 MB stack. The test uses
1,000,000 levels to keep a margin for a larger stack.

GHSA-x33g-cr3x-6449, medium, is not reachable: it is about OKP private JWKs
whose public x part does not agree with the private d part. verify_jws uses
only the public keys of the issuer JWKS.

Also in 2.15.0, and reachable from the JWKS of a configured issuer:
PyJWKClient wraps http.client.HTTPException, for example IncompleteRead from
a truncated response, in PyJWKClientConnectionError, which verify_jws
catches. A JWK Set member that is not correct is skipped, and does not make
the whole set fail. An exp, nbf or iat claim that is a list, a dict or null
raises a PyJWTError instead of a TypeError. That check occurs after the
signature check, so only the issuer can send such a claim.

2.15.0 does not fix the same RecursionError on the JWKS response.
PyJWKClient.fetch_data still c... (continued)

52830 of 58114 relevant lines covered (90.91%)

0.91 hits per line

Jobs
ID Job ID Ran Files Coverage
1 36227682781.1 1035
90.91
 GitHub Action Run
Source Files on build 36227682781