{ "@id": "urn:uuid:aad63dd0-a2d9-4a0e-bcd5-2b7967bf2d15", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-01T08:48:43.786965+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T15:57:50.734473+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.8.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post1+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48524" }, "action_statement": "Vulnerability CVE-2026-48524 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post1+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48526" }, "action_statement": "Vulnerability CVE-2026-48526 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post2+tuxcare." } ] }