Algorithm Confusion Vulnerability in python-authlib Package
Summary
DEBIAN-CVE-2024-37568: lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Affects python-authlib versions < 1.3.1-1. Fixed in 1.3.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-authlib package is a popular library in the Python ecosystem, primarily used for implementing OAuth and OpenID Connect protocols. It provides tools for creating and verifying JSON Web Tokens (JWTs) and managing authentication flows. However, prior to version 1.3.1, the package was susceptible to an algorithm confusion vulnerability that could lead to security risks when handling asymmetric public keys.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-37568 affects versions of python-authlib before 1.3.1. It arises from an algorithm confusion issue where, if no algorithm is specified in a jwt.decode call, HMAC verification can be performed using any asymmetric public key. This flaw can potentially allow an attacker to bypass security measures, leading to unauthorized access or manipulation of sensitive data. This vulnerability is similar to previously reported issues such as CVE-2022-29217 and CVE-2024-33663.
How To Fix
Minimum fixed version
1.3.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-authlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can specify the algorithm explicitly in the jwt.decode calls to mitigate the risk of algorithm confusion. For example: jwt.decode(token, key, algorithms=['HS256']) ensures that only the specified algorithm is used for verification.
Conclusion
The algorithm confusion vulnerability in the python-authlib package poses significant security risks if not addressed. Users are strongly encouraged to update to the patched version 1.3.1-1 or later to mitigate these risks. Additionally, specifying algorithms in JWT handling can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-authlib →
FAQ
The vulnerability allows HMAC verification with any asymmetric public key if no algorithm is specified, potentially leading to unauthorized access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, ensure to specify the algorithm in your jwt.decode calls as a temporary measure.
While specific exploits have not been publicly disclosed, the nature of the vulnerability suggests that it could be exploited by attackers familiar with JWT handling.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-37568.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-authlib.
