Files
meta-openembedded/meta-python/recipes-devtools/python
Hetvi Thakar 773e345eca python3-pyjwt: Fix CVE-2026-48522
Restrict PyJWKClient JWKS retrieval to HTTP and HTTPS. urllib
otherwise accepts schemes such as file, FTP and data, allowing
attacker-influenced URLs to reach unintended resources.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-993g-76c3-p5m4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-08-12 09:35:10 +05:30
..
2024-04-07 08:36:34 -07:00
2024-03-04 08:56:51 -08:00
2025-04-26 15:50:27 -04:00
2024-02-19 23:22:24 -08:00
2025-04-26 15:50:27 -04:00