{"id":"CVE-2017-12880","aliases":["EUVD-2017-4404","SUSE-SU-2017:3370-1","SUSE-SU-2021:2010-1"],"status":"rejected","title":"Security update for python-PyJWT","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-11424.  Reason: This candidate is a duplicate of CVE-2017-11424.  Notes: All CVE users should reference CVE-2017-11424 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-08-16T14:00:00Z","modified":"2026-02-04T04:34:08Z","fixes":[{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-PyJWT","fixed_in":["1.4.2-3.3.1","1.5.3-3.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-PyJWT","fixed_in":["1.4.2-3.3.1","1.5.3-3.13.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-PyJWT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-PyJWT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-PyJWT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-3.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-PyJWT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-3.13.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173370-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054106","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12880","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212010-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186173","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-12880","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-11424.  Reason: This candidate is a duplicate of CVE-2017-11424.  Notes: All CVE users should reference CVE-2017-11424 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2017-08-16T14:00:00Z","modified":"2017-08-16T18:57:01Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-4404","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-11424.  Reason: This candidate is a duplicate of CVE-2017-11424.  Notes: All CVE users should reference CVE-2017-11424 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2017-08-16T14:00:00Z","modified":"2017-08-16T18:57:01Z","updated_at":"2026-11-03T04:07:48.301361Z"}],"nvd":[{"id":"CVE-2017-12880","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-11424.  Reason: This candidate is a duplicate of CVE-2017-11424.  Notes: All CVE users should reference CVE-2017-11424 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2017-08-16T14:29:00.177Z","modified":"2023-11-07T02:38:31.87Z","updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"SUSE-SU-2017:3370-1","title":"Security update for python-PyJWT","description":"This update for python-PyJWT fixes the following issues:\n\n- CVE-2017-12880: fix symmetric/asymmetric confusion when handling PKCS1 public keys (bsc#1054106)\n","status":"published","published":"2017-12-19T07:41:49Z","modified":"2026-02-04T03:21:18.977817Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2021:2010-1","title":"Security update for python-PyJWT","description":"This update for python-PyJWT fixes the following issues:\n\npython-JWT was updated to 1.5.3. (bsc#1186173)\n\nupdate to version 1.5.3:\n\n  * Changed\n\n    + Increase required version of the cryptography package to\n      \u003e=1.4.0.\n\n  * Fixed\n\n    + Remove uses of deprecated functions from the cryptography\n      package.\n    + Warn about missing algorithms param to decode() only when verify\n      param is True #281\n\n\nupdate to version 1.5.2:\n\n- Ensure correct arguments order in decode super call [7c1e61d][7c1e61d]\n- Change optparse for argparse. [#238][238]\n- Guard against PKCS1 PEM encododed public keys [#277][277]\n- Add deprecation warning when decoding without specifying `algorithms` [#277][277]\n- Improve deprecation messages [#270][270]\n- PyJWT.decode: move verify param into options [#271][271]\n- Support for Python 3.6 [#262][262]\n- Expose jwt.InvalidAlgorithmError [#264][264]\n- Add support for ECDSA public keys in RFC 4253 (OpenSSH) format [#244][244]\n- Renamed commandline script `jwt` to `jwt-cli` to avoid issues with the script clobbering the `jwt` module in some circumstances. [#187][187]\n- Better error messages when using an algorithm that requires the cryptography package, but it isn't available [#230][230]\n- Tokens with future 'iat' values are no longer rejected [#190][190]\n- Non-numeric 'iat' values now raise InvalidIssuedAtError instead of DecodeError\n- Remove rejection of future 'iat' claims [#252][252]\n- Add back 'ES512' for backward compatibility (for now) [#225][225]\n- Fix incorrectly named ECDSA algorithm [#219][219]\n- Fix rpm build [#196][196]\n- Add JWK support for HMAC and RSA keys [#202][202]\n\n","status":"published","published":"2021-06-18T07:03:27Z","modified":"2026-02-04T04:34:08.551817Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}