3 Commits

Include renames

Author	SHA1	Message	Date
Hetvi Thakar	fffe550dfc	python3-pyjwt: Fix CVE-2026-48524 ... Preserve a valid cached JWK set when a refresh request fails. The previous finally block stored None on errors, turning a transient JWKS outage into an authentication failure for otherwise cached keys. This patch applies the relevant subset of the upstream 2.13.0 fix. The upstream commit is referenced in [1], and the public advisory is referenced in [2]. [1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81 [2] https://github.com/advisories/GHSA-fhv5-28vv-h8m8 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>	2026-08-12 09:35:11 +05:30
Hetvi Thakar	773e345eca	python3-pyjwt: Fix CVE-2026-48522 ... Restrict PyJWKClient JWKS retrieval to HTTP and HTTPS. urllib otherwise accepts schemes such as file, FTP and data, allowing attacker-influenced URLs to reach unintended resources. This patch applies the relevant subset of the upstream 2.13.0 fix. The upstream commit is referenced in [1], and the public advisory is referenced in [2]. [1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81 [2] https://github.com/advisories/GHSA-993g-76c3-p5m4 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>	2026-08-12 09:35:10 +05:30
Hitendra Prajapati	d3a45ead9c	python3-pyjwt: Fix CVE-2026-32597 ... Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32597 Backport commit[1] which fixes this vulnerability as mentioned in [2]. [1] https://github.com/jpadilla/pyjwt/commit/051ea341b5573fe3edcd53042f347929b92c2b92 [2] https://security-tracker.debian.org/tracker/CVE-2026-32597 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>	2026-03-24 08:52:14 +05:30