commonground-api-common
Shared functions between Common Ground API components
View on Github
Activity
- Latest release
- 1d ago
- Total releases
- 54
- Cadence
- ~11 days
- Last 12 months
- 15
Reach
- Stars
- 0
Details
- License
- MIT
- First release
- Dec 12, 2022
| Version | Released | |
|---|---|---|
2.16.0
minor
| ||
2.15.2
patch
| ||
2.15.1
patch
| ||
2.15.0
minor
| ||
2.14.0
minor
| ||
2.13.0
minor
| ||
2.12.0
minor
| ||
2.11.0
minor
| ||
2.10.7
patch
| ||
2.10.6
patch
| ||
2.10.5
patch
| ||
2.10.4
patch
| ||
2.10.3
patch
| ||
2.10.2
patch
| ||
2.10.1
patch
| ||
2.10.0
minor
| ||
2.9.0
minor
| ||
2.8.0
minor
| ||
2.7.0
minor
| ||
2.6.7
patch
| ||
2.6.6
patch
| ||
2.6.5
patch
| ||
2.6.4
patch
| ||
2.6.3
patch
| ||
2.6.2
patch
| ||
2.6.1
patch
| ||
2.6.0
minor
| ||
2.5.5
patch
| ||
2.5.4
patch
| ||
2.5.3
patch
| ||
2.5.2
patch
| ||
2.5.1
patch
| ||
2.5.0
minor
| ||
2.4.1
patch
| ||
2.4.0
minor
| ||
2.3.0
minor
| ||
2.2.0
minor
| ||
2.1.2
patch
| ||
2.1.0
minor
| ||
2.0.1
patch
| ||
2.0.0
major
| ||
1.13.4
patch
| ||
1.13.3
patch
| ||
1.13.2
patch
| ||
1.13.1
patch
| ||
1.13.0
minor
| ||
1.12.2
patch
| ||
1.12.1
patch
1 CVE
GHSA-c4cm-r9fh-jgj9
Feb 09, 2024
commonground-api-common unexploitable privilege escalation in JWT authentication middleware
Low
ImpactThis is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the PyJWT library, user-supplied (invalid) algorithms are rejected. If this was not the case, then the client JWTs could be tampered with, resulting in privilege escalation which would allow the attacker to perform any operation as any client (impersonation) without leaving a trace of the real user/client. PatchesWill be fixed in 1.12.2 WorkaroundsNone needed. But be careful when updating PyJWT. Check that the used PyJWT has no algorithms specified with a name in "", "HS25", "HS2", "HS", "H", or that those algorithms are acceptable. DetailsThe header and payload of JSON Web Tokens (JWTs) are cryptographically signed with an algorithm. A JWT has a header field The Affected versions
1.10.0
1.10.1
1.10.2
1.11.0
1.12.0
1.12.1
1.9.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
1.12.0
minor
1 CVE
GHSA-c4cm-r9fh-jgj9
Feb 09, 2024
commonground-api-common unexploitable privilege escalation in JWT authentication middleware
Low
ImpactThis is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the PyJWT library, user-supplied (invalid) algorithms are rejected. If this was not the case, then the client JWTs could be tampered with, resulting in privilege escalation which would allow the attacker to perform any operation as any client (impersonation) without leaving a trace of the real user/client. PatchesWill be fixed in 1.12.2 WorkaroundsNone needed. But be careful when updating PyJWT. Check that the used PyJWT has no algorithms specified with a name in "", "HS25", "HS2", "HS", "H", or that those algorithms are acceptable. DetailsThe header and payload of JSON Web Tokens (JWTs) are cryptographically signed with an algorithm. A JWT has a header field The Affected versions
1.10.0
1.10.1
1.10.2
1.11.0
1.12.0
1.12.1
1.9.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
1.11.0
minor
1 CVE
GHSA-c4cm-r9fh-jgj9
Feb 09, 2024
commonground-api-common unexploitable privilege escalation in JWT authentication middleware
Low
ImpactThis is a privilege escalation vulnerability. The impact is negligible and entirely theoretical. A non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list of known algorithms is used in the PyJWT library, user-supplied (invalid) algorithms are rejected. If this was not the case, then the client JWTs could be tampered with, resulting in privilege escalation which would allow the attacker to perform any operation as any client (impersonation) without leaving a trace of the real user/client. PatchesWill be fixed in 1.12.2 WorkaroundsNone needed. But be careful when updating PyJWT. Check that the used PyJWT has no algorithms specified with a name in "", "HS25", "HS2", "HS", "H", or that those algorithms are acceptable. DetailsThe header and payload of JSON Web Tokens (JWTs) are cryptographically signed with an algorithm. A JWT has a header field The Affected versions
1.10.0
1.10.1
1.10.2
1.11.0
1.12.0
1.12.1
1.9.0
References Updated Dec 06, 2024 · Source: OSV.dev |