USN-5526-2
pyjwt regression
USN-5526-1 fixed vulnerabilities in PyJWT. Unfortunately this caused a regression by incrementing the internal package version number on Ubuntu 22.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Aapo Oksman discovered that PyJWT incorrectly handled signatures constructed from SSH public keys. A remote attacker could use this to forge a JWT signature.
What each source reports
OSV No score
pyjwt regression
USN-5526-1 fixed vulnerabilities in PyJWT. Unfortunately this caused a regression by incrementing the internal package version number on Ubuntu 22.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Aapo Oksman discovered that PyJWT incorrectly handled signatures constructed from SSH public keys. A remote attacker could use this to forge a JWT signature.
- Record
USN-5526-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyjwtUbuntu:22.04:LTS |
before 2.3.0-1ubuntu0.2, plus listed versions 1.7.1-2ubuntu22.1.0-12.3.0-12.3.0-1ubuntu0.1 |
2.3.0-1ubuntu0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-5526-2 is a vulnerability with no CVSS score yet in pyjwt, published August 17, 2022. No source lists public exploit code. Fixed in pyjwt 2.3.0-1ubuntu0.2.