Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZwam0tcnAyZy0zcjRj

Django Rest Framework jwt allows obtaining new token from notionally invalidated token

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.

Permalink: https://github.com/advisories/GHSA-fpjm-rp2g-3r4c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZwam0tcnAyZy0zcjRj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: 23 days ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-fpjm-rp2g-3r4c, CVE-2020-10594
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-10594
• https://github.com/Styria-Digital/django-rest-framework-jwt/issues/36
• https://github.com/jpadilla/django-rest-framework-jwt/issues/484
• https://github.com/Styria-Digital/django-rest-framework-jwt/commit/868b5c22ddad59772b447080183e7c7101bb18e0
• https://pypi.org/project/drf-jwt/1.15.1/#history
• https://github.com/advisories/GHSA-fpjm-rp2g-3r4c
• https://github.com/pypa/advisory-database/tree/main/vulns/drf-jwt/PYSEC-2020-40.yaml

Repository: https://github.com/Styria-Digital/django-rest-framework-jwt
Blast Radius: 22.4

Affected Packages