From f1444be16f588b7b1ab1d7e60121b56283daa858 Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 15 Oct 2026 19:33:21 -0700 Subject: [PATCH] python3-pyjwt: fix CVE-2026-102275 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c [2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../python/files/CVE-2026-102275.patch | 82 +++++++++++++++++++ .../python/python3-pyjwt_2.12.1.bb | 1 + 2 files changed, 83 insertions(+) create mode 100644 meta-python/recipes-devtools/python/files/CVE-2026-102275.patch diff --git a/meta-python/recipes-devtools/python/files/CVE-2026-102275.patch b/meta-python/recipes-devtools/python/files/CVE-2026-102275.patch new file mode 100644 index 0000000000..1aab8773d2 --- /dev/null +++ b/meta-python/recipes-devtools/python/files/CVE-2026-102275.patch @@ -0,0 +1,82 @@ +From 3cd9ceec33ced359decbad75b413ad668ae6332c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Padilla?= +Date: Fri, 11 Sep 2026 22:29:12 -0400 +Subject: [PATCH] fix: reject inconsistent OKP private keys + +CVE: CVE-2026-102275 +Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c] + +(cherry picked from commit 3cd9ceec33ced359decbad75b413ad668ae6332c) +Signed-off-by: Hetvi Thakar +--- + jwt/algorithms.py | 14 ++++++++++++-- + tests/test_algorithms.py | 29 +++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 2 deletions(-) + +diff --git a/jwt/algorithms.py b/jwt/algorithms.py +index 432fdcf..03976c9 100644 +--- a/jwt/algorithms.py ++++ b/jwt/algorithms.py +@@ -1036,8 +1036,18 @@ if has_crypto: + return Ed25519PublicKey.from_public_bytes(x) + return Ed448PublicKey.from_public_bytes(x) + d = base64url_decode(obj.get("d")) ++ private_key: Ed25519PrivateKey | Ed448PrivateKey + if curve == "Ed25519": +- return Ed25519PrivateKey.from_private_bytes(d) +- return Ed448PrivateKey.from_private_bytes(d) ++ private_key = Ed25519PrivateKey.from_private_bytes(d) ++ else: ++ private_key = Ed448PrivateKey.from_private_bytes(d) ++ if ( ++ private_key.public_key().public_bytes( ++ encoding=Encoding.Raw, format=PublicFormat.Raw ++ ) ++ != x ++ ): ++ raise InvalidKeyError("Public key does not match private key") ++ return private_key + except ValueError as err: + raise InvalidKeyError("Invalid key parameter") from err +diff --git a/tests/test_algorithms.py b/tests/test_algorithms.py +index acaa1fe..089b881 100644 +--- a/tests/test_algorithms.py ++++ b/tests/test_algorithms.py +@@ -933,6 +933,35 @@ class TestAlgorithmsRFC7520: + + @crypto_required + class TestOKPAlgorithms: ++ @pytest.mark.parametrize("curve", ("Ed25519", "Ed448")) ++ @pytest.mark.parametrize("as_dict", (False, True)) ++ def test_okp_jwk_should_reject_inconsistent_private_key( ++ self, curve: str, as_dict: bool ++ ) -> None: ++ with open(key_path(f"jwk_okp_key_{curve}.json")) as keyfile: ++ jwk = json.load(keyfile) ++ ++ d = base64url_decode(jwk["d"]) ++ jwk["d"] = ( ++ base64.urlsafe_b64encode(bytes([d[0] ^ 1]) + d[1:]).rstrip(b"=").decode() ++ ) ++ ++ with pytest.raises(InvalidKeyError): ++ OKPAlgorithm.from_jwk(jwk if as_dict else json.dumps(jwk)) ++ ++ @pytest.mark.parametrize("curve", ("Ed25519", "Ed448")) ++ @pytest.mark.parametrize("length", (0, 1, 56, 58)) ++ def test_okp_jwk_should_reject_private_key_with_invalid_public_length( ++ self, curve: str, length: int ++ ) -> None: ++ with open(key_path(f"jwk_okp_key_{curve}.json")) as keyfile: ++ jwk = json.load(keyfile) ++ ++ jwk["x"] = base64.urlsafe_b64encode(b"\x00" * length).rstrip(b"=").decode() ++ ++ with pytest.raises(InvalidKeyError): ++ OKPAlgorithm.from_jwk(jwk) ++ + hello_world_sig = b"Qxa47mk/azzUgmY2StAOguAd4P7YBLpyCfU3JdbaiWnXM4o4WibXwmIHvNYgN3frtE2fcyd8OYEaOiD/KiwkCg==" + hello_world_sig_pem = b"9ueQE7PT8uudHIQb2zZZ7tB7k1X3jeTnIfOVvGCINZejrqQbru1EXPeuMlGcQEZrGkLVcfMmr99W/+byxfppAg==" + hello_world = b"Hello World!" +-- +2.35.6 diff --git a/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb index 25f2451b2f..8953a781de 100644 --- a/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb +++ b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb @@ -17,6 +17,7 @@ SRC_URI += "file://CVE-2026-48522.patch \ file://CVE-2026-102268_CVE-2026-102270.patch \ file://CVE-2026-102271.patch \ file://CVE-2026-101917.patch \ + file://CVE-2026-102275.patch \ " SRC_URI[sha256sum] = "c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"