[GHSA-993g-76c3-p5m4] PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

[shaked-seal]

Updates

• Affected products

Comments
The vulnerable code path — PyJWKClient.fetch_data() calling urllib.request.urlopen() on a caller/attacker-influenced URI without restricting the URL scheme — exists entirely within the PyJWKClient class (jwt/jwks_client.py).
That class did not exist before PyJWT 2.0.0. It was introduced in commit dee2d31640940bfc77c3bc5839587a082eae58a4 ("Introduce better experience for JWKs", PR #511, 2020-08-24) and first released in 2.0.0. I verified jwt/jwks_client.py is present at the 2.0.0 tag with fetch_data already using urllib.request.urlopen(self.uri), and is absent from every earlier tag (e.g. 1.7.1, 2018-12-06); git merge-base --is-ancestor dee2d31 1.7.1 returns false.
The current affected range <= 2.12.1 therefore incorrectly includes the entire 1.x line (and earlier), none of which ship PyJWKClient, jwt/jwks_client.py, or any urllib-based JKU/JWKS fetching. The range should be lower-bounded to the release that introduced the affected component: >= 2.0.0, < 2.13.0.

[github]

Hi there @jpadilla! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory