جزئیات آسیب‌پذیری
CVE-2026-32597
Red Hat OpenShift LightspeedRed Hat AI Inference ServerRed Hat Ansible Automation Platform 2Red Hat OpenShift AIRed Hat Satellite 6Red Hat Trusted Artifact Signer
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
CVSS 3.1
7.5بالا
شرح رسمی (انگلیسی)
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Artifact Signer | همه | CVEProject cvelistV5 (CNA) |
| jpadilla | pyjwt | < 2.12.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۳۵- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f x_refsource_CONFIRM
- https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html
- https://access.redhat.com/security/cve/CVE-2026-32597 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2447194 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:13512 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13508 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17083 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13916 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19138 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12176 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22330 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21517 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21431 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13672 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19355 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8748 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8746 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8747 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13553 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10140 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10141 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24977 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6912 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6720 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6568 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19375 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6926 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26226 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8437 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۲/۲۲
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۹
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۲۹٪
احتمال بهره‌برداری در ۳۰ روز
۲۲٫۷٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-345Insufficient Verification of Data Authenticity
- CWE-863Incorrect Authorization
- CWE-347Improper Verification of Cryptographic Signature