python-jose

python-jose copied to clipboard

Use correct iv size (#281)

3

Use a 12 byte IV for GCM based algorithms and 16 byte IV for CBC based ones. This makes a JWE compatible with other libraries based on OpenSSL which can...

jkamp-aws

[Vuln] JWT bomb Attack in decode function

12

# JWT bomb Attack in decode function ## 0x01 Affected version vendor: https://github.com/mpdavis/python-jose version: 3.3.0 ## 0x02 What kind of vulnerability is it? Who is impacted? This vulnerability allows an...

P3ngu1nW

Vulnerability on dependency (ecdsa), not planned to be fixed

15

Hello, The `ecdsa` package is a requirement for this project. There is a vulnerability affecting the latest version (`0.18.0`), but the maintainers don't plan to fix it. More information here:...

Merinorus

Hi, I'm using `jwt.encode` with algorithm `RS256` on my api, and since upgrading the dependencies I've noticed an increase in the call duration of `jwt.encode` The duration is used to...

Tamar-Shemesh

resolves #321, Added support for passing additional headers in JWE encryption.

6

[JWS](https://datatracker.ietf.org/doc/html/rfc7515) and [JWE](https://datatracker.ietf.org/doc/html/rfc7516), both spec have the provision of custom (i.e. user-defined) headers. *python-jose* supports passing custom headers in the `headers` parameter in `jose.jws.sign()` method. But the same is not...

debanshuk

Is python-jose still supported?

4

I see there have been no releases in a couple of years and issues/pull requests stacking up in this repo. Can anybody who still maintains this library comment on its...

jusdino

Resolve deprecation warnings related to datetime.utcnow in python 3.12

7

When upgrading my project to python 3.12, I started seeing deprecation warnings related to the use of `datetime.datetime.utcnow`. ``` /Users/br/.../lib/python3.12/site-packages/jose/jwt.py:311: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a...

brouberol

Deprecation warning from python 3.12

2

python 3.12 deprecated the use of `.utcnow()`, and therefore there are deprecation warnings when creating JWTs: ```

spapanik

Fix small mistake on HMAC jwk example

1

```python >>> decoded_sig = base64url_decode(encoded_sig) Traceback (most recent call last): (...) File "(...)/python3.11/site-packages/jose/utils.py", line 76, in base64url_decode input += b"=" * (4 - rem) TypeError: can only concatenate str (not...

leandropls

Updated pyasn version to match latest

1

Updated pyasn to match version 0.5.0. Seems to be passing all tests as well . Closes: #312

viraj-s15