python3-pyjwt: fix CVE-2026-102268 and CVE-2026-102270

This patch applies the shared upstream fix as referenced in [2] and [3], using the commit shown in [1]. [1] https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07 [2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9 [3] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-11-13 15:47:23 +00:00 · 2026-10-28 12:31:36 +05:30
1 parent 6febd066de
commit 2d80df4fa5
@@ -0,0 +1,113 @@
+From 8b4e233a22206b34ec1186e912e75c0b2396ac07 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Padilla?= <jpadilla@users.noreply.github.com>
+Date: Wed, 9 Sep 2026 21:49:21 -0400
+Subject: [PATCH] fix: reject loader-accepted PEM variants
+
+CVE: CVE-2026-102268 CVE-2026-102270
+Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07]
+
+(cherry picked from commit 8b4e233a22206b34ec1186e912e75c0b2396ac07)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ jwt/utils.py             | 20 ++++++++++--------
+ tests/test_algorithms.py | 44 +++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 55 insertions(+), 9 deletions(-)
+
+diff --git a/jwt/utils.py b/jwt/utils.py
+index 56e89bb..914cb50 100644
+--- a/jwt/utils.py
+++ b/jwt/utils.py
+@@ -113,18 +113,22 @@ _PEMS = {
+     b"X509 CRL",
+ }
+ 
+-_PEM_RE = re.compile(
+-    b"----[- ]BEGIN ("
+-    + b"|".join(_PEMS)
+-    + b""")[- ]----\r?
+-.+?\r?
+-----[- ]END \\1[- ]----\r?\n?""",
+-    re.DOTALL,
+# Accept PEM formatting variants that the cryptography loader accepts, while
+# retaining the explicit asymmetric-key marker check.
+_PEM_MARKER_RE = re.compile(
+    b"(?=(----[- ](BEGIN|END) (" + b"|".join(_PEMS) + b")[- ]----))"
+ )
+ 
+ 
+ def is_pem_format(key: bytes) -> bool:
+-    return bool(_PEM_RE.search(key))
+    begin_markers: dict[bytes, int] = {}
+    for marker in _PEM_MARKER_RE.finditer(key):
+        marker_type, label = marker.group(2), marker.group(3)
+        if marker_type == b"BEGIN":
+            begin_markers[label] = marker.start(1) + len(marker.group(1))
+        elif label in begin_markers and begin_markers[label] < marker.start(1):
+            return True
+    return False
+ 
+ 
+ # Based on https://github.com/pyca/cryptography/blob/bcb70852d577b3f490f015378c75cba74986297b/src/cryptography/hazmat/primitives/serialization/ssh.py#L40-L46
+diff --git a/tests/test_algorithms.py b/tests/test_algorithms.py
+index 82659cf..4e149a7 100644
+--- a/tests/test_algorithms.py
+++ b/tests/test_algorithms.py
+@@ -1,6 +1,6 @@
+ import base64
+ import json
+-from typing import Union, cast
+from typing import Callable, Union, cast
+ 
+ import pytest
+ 
+@@ -89,6 +89,48 @@ class TestAlgorithms:
+             with open(key_path(key)) as keyfile:
+                 algo.prepare_key(keyfile.read())
+ 
+    @pytest.mark.parametrize(
+        "mutation",
+        [
+            lambda key: key.replace(b"-----END", b"\t-----END"),
+            lambda key: key.replace(b"\n", b"\r"),
+            lambda key: key.replace(b"\n", b""),
+        ],
+    )
+    def test_hmac_should_reject_loader_accepted_pem_mutations(
+        self, mutation: Callable[[bytes], bytes]
+    ) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        with open(key_path("testkey2_rsa.pub.pem"), "rb") as keyfile:
+            mutated_key = mutation(keyfile.read())
+
+        with pytest.raises(InvalidKeyError):
+            algo.prepare_key(mutated_key)
+
+    def test_hmac_should_accept_incomplete_pem_marker(self) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        key = b"-----BEGIN PUBLIC KEY-----" * 10000
+
+        assert algo.prepare_key(key) == key
+
+    def test_hmac_should_reject_a_later_pem_block(self) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        with open(key_path("testkey2_rsa.pub.pem"), "rb") as keyfile:
+            key = b"-----BEGIN PUBLIC KEY-----" + keyfile.read()
+
+        with pytest.raises(InvalidKeyError):
+            algo.prepare_key(key)
+
+    def test_hmac_should_reject_a_pem_block_after_an_overlapping_end_marker(
+        self,
+    ) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        with open(key_path("testkey2_rsa.pub.pem"), "rb") as keyfile:
+            key = b"-----END CERTIFICATE" + keyfile.read()
+
+        with pytest.raises(InvalidKeyError):
+            algo.prepare_key(key)
+
+     def test_hmac_jwk_should_parse_and_verify(self) -> None:
+         algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+ 
+-- 
+2.35.6
@@ -14,6 +14,7 @@ SRC_URI += "file://CVE-2026-48522.patch \
           file://CVE-2026-102274.patch \
           file://CVE-2026-102269.patch \
           file://CVE-2026-102267.patch \
+           file://CVE-2026-102268_CVE-2026-102270.patch \
           "

 SRC_URI[sha256sum] = "c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"