[GHSA-fhv5-28vv-h8m8] PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

[shaked-seal]

Updates

• Affected products

Comments
This advisory concerns behavior in PyJWKClient (jwt/jwks_client.py) — the unbounded HTTP request to the JWKS endpoint for every unknown kid, and (per the 2.13.0 fix) clearing the JWKS cache on network errors. Both live entirely in PyJWKClient, which did not exist before PyJWT 2.0.0: it was introduced in commit dee2d31640940bfc77c3bc5839587a082eae58a4 ("Introduce better experience for JWKs", PR #511, 2020-08-24) and first released in 2.0.0, where fetch_data() already issues urllib.request.urlopen(self.uri) on every lookup.
Every 1.x release (through 1.7.1, 2018-12-06) contains no jwt/jwks_client.py and no PyJWKClient — verified: the file is absent from the 1.7.1 tag and git merge-base --is-ancestor dee2d31 1.7.1 returns false. The current <= 2.12.1 range therefore incorrectly includes the entire 1.x line, none of which can be affected. It should be lower-bounded to the release that introduced the affected component: >= 2.0.0, < 2.13.0.

[github]

Hi there @jpadilla! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory