python-jwt: token verification bypass
| Package(s): | python-jwt | CVE #(s): | |||||||||
| Created: | June 30, 2015 | Updated: | July 1, 2015 | ||||||||
| Description: | From the Red Hat bugzilla:
If the secretKey was expected to be a RSA public key, but the attacker changed the header to indicate a signature algorithm of HMAC, the RSA public key would be used as the signing secret. | ||||||||||
| Alerts: |
| ||||||||||