From 2d80df4fa5c137f4ff1d19968780a75186697724 Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 15 Oct 2026 19:33:18 -0700 Subject: [PATCH] python3-pyjwt: fix CVE-2026-102268 and CVE-2026-102270 This patch applies the shared upstream fix as referenced in [2] and [3], using the commit shown in [1]. [1] https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07 [2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9 [3] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../CVE-2026-102268_CVE-2026-102270.patch | 113 ++++++++++++++++++ .../python/python3-pyjwt_2.12.1.bb | 1 + 2 files changed, 114 insertions(+) create mode 100644 meta-python/recipes-devtools/python/files/CVE-2026-102268_CVE-2026-102270.patch diff --git a/meta-python/recipes-devtools/python/files/CVE-2026-102268_CVE-2026-102270.patch b/meta-python/recipes-devtools/python/files/CVE-2026-102268_CVE-2026-102270.patch new file mode 100644 index 0000000000..a845cb9065 --- /dev/null +++ b/meta-python/recipes-devtools/python/files/CVE-2026-102268_CVE-2026-102270.patch @@ -0,0 +1,113 @@ +From 8b4e233a22206b34ec1186e912e75c0b2396ac07 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Padilla?= +Date: Wed, 9 Sep 2026 21:49:21 -0400 +Subject: [PATCH] fix: reject loader-accepted PEM variants + +CVE: CVE-2026-102268 CVE-2026-102270 +Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07] + +(cherry picked from commit 8b4e233a22206b34ec1186e912e75c0b2396ac07) +Signed-off-by: Hetvi Thakar +--- + jwt/utils.py | 20 ++++++++++-------- + tests/test_algorithms.py | 44 +++++++++++++++++++++++++++++++++++++++- + 2 files changed, 55 insertions(+), 9 deletions(-) + +diff --git a/jwt/utils.py b/jwt/utils.py +index 56e89bb..914cb50 100644 +--- a/jwt/utils.py ++++ b/jwt/utils.py +@@ -113,18 +113,22 @@ _PEMS = { + b"X509 CRL", + } + +-_PEM_RE = re.compile( +- b"----[- ]BEGIN (" +- + b"|".join(_PEMS) +- + b""")[- ]----\r? +-.+?\r? +-----[- ]END \\1[- ]----\r?\n?""", +- re.DOTALL, ++# Accept PEM formatting variants that the cryptography loader accepts, while ++# retaining the explicit asymmetric-key marker check. ++_PEM_MARKER_RE = re.compile( ++ b"(?=(----[- ](BEGIN|END) (" + b"|".join(_PEMS) + b")[- ]----))" + ) + + + def is_pem_format(key: bytes) -> bool: +- return bool(_PEM_RE.search(key)) ++ begin_markers: dict[bytes, int] = {} ++ for marker in _PEM_MARKER_RE.finditer(key): ++ marker_type, label = marker.group(2), marker.group(3) ++ if marker_type == b"BEGIN": ++ begin_markers[label] = marker.start(1) + len(marker.group(1)) ++ elif label in begin_markers and begin_markers[label] < marker.start(1): ++ return True ++ return False + + + # Based on https://github.com/pyca/cryptography/blob/bcb70852d577b3f490f015378c75cba74986297b/src/cryptography/hazmat/primitives/serialization/ssh.py#L40-L46 +diff --git a/tests/test_algorithms.py b/tests/test_algorithms.py +index 82659cf..4e149a7 100644 +--- a/tests/test_algorithms.py ++++ b/tests/test_algorithms.py +@@ -1,6 +1,6 @@ + import base64 + import json +-from typing import Union, cast ++from typing import Callable, Union, cast + + import pytest + +@@ -89,6 +89,48 @@ class TestAlgorithms: + with open(key_path(key)) as keyfile: + algo.prepare_key(keyfile.read()) + ++ @pytest.mark.parametrize( ++ "mutation", ++ [ ++ lambda key: key.replace(b"-----END", b"\t-----END"), ++ lambda key: key.replace(b"\n", b"\r"), ++ lambda key: key.replace(b"\n", b""), ++ ], ++ ) ++ def test_hmac_should_reject_loader_accepted_pem_mutations( ++ self, mutation: Callable[[bytes], bytes] ++ ) -> None: ++ algo = HMACAlgorithm(HMACAlgorithm.SHA256) ++ with open(key_path("testkey2_rsa.pub.pem"), "rb") as keyfile: ++ mutated_key = mutation(keyfile.read()) ++ ++ with pytest.raises(InvalidKeyError): ++ algo.prepare_key(mutated_key) ++ ++ def test_hmac_should_accept_incomplete_pem_marker(self) -> None: ++ algo = HMACAlgorithm(HMACAlgorithm.SHA256) ++ key = b"-----BEGIN PUBLIC KEY-----" * 10000 ++ ++ assert algo.prepare_key(key) == key ++ ++ def test_hmac_should_reject_a_later_pem_block(self) -> None: ++ algo = HMACAlgorithm(HMACAlgorithm.SHA256) ++ with open(key_path("testkey2_rsa.pub.pem"), "rb") as keyfile: ++ key = b"-----BEGIN PUBLIC KEY-----" + keyfile.read() ++ ++ with pytest.raises(InvalidKeyError): ++ algo.prepare_key(key) ++ ++ def test_hmac_should_reject_a_pem_block_after_an_overlapping_end_marker( ++ self, ++ ) -> None: ++ algo = HMACAlgorithm(HMACAlgorithm.SHA256) ++ with open(key_path("testkey2_rsa.pub.pem"), "rb") as keyfile: ++ key = b"-----END CERTIFICATE" + keyfile.read() ++ ++ with pytest.raises(InvalidKeyError): ++ algo.prepare_key(key) ++ + def test_hmac_jwk_should_parse_and_verify(self) -> None: + algo = HMACAlgorithm(HMACAlgorithm.SHA256) + +-- +2.35.6 diff --git a/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb index f7134a1367..b93806fe48 100644 --- a/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb +++ b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb @@ -14,6 +14,7 @@ SRC_URI += "file://CVE-2026-48522.patch \ file://CVE-2026-102274.patch \ file://CVE-2026-102269.patch \ file://CVE-2026-102267.patch \ + file://CVE-2026-102268_CVE-2026-102270.patch \ " SRC_URI[sha256sum] = "c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"