{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3eda537e-e190-5c78-9f37-328ed2a962bd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "version": "2.8.0.post5+tuxcare", "pedigree": { "ancestors": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.8.0", "type": "library", "version": "2.8.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-45768", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:a8dcd853-440b-5892-8612-bf0126d3f268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-101917", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:888c27a8-6b55-56b4-84ca-7a10872eb73f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101917 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-101918", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d73ea4b5-fbc9-5ed1-a6a4-d1d608807505", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101918 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-102267", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:907bb371-4c5e-5175-9812-a04e6870ba15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102267 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-102268", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5f689c0c-9903-5800-8d40-420fe2a71a50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102268 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-102269", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:e43d0d23-ee54-5555-9ffe-0af5973e5d4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102269 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-102270", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:ad8a5c4c-aa0a-55ee-bc45-80be6ccb647c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102270 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-102271", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:70e80b63-8134-52cb-8062-4f5f257596f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102271 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-102275", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:6c79b45c-936a-5897-99df-f31b8b5bb4c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102275 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-32597", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:32fe8959-4638-50a4-a19b-c1bf2dce9243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32597 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-48522", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:a24ce0c0-56b5-54eb-85fe-1322ae47b04a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post5+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "code_not_present" } }, { "id": "CVE-2026-48524", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d248342e-7663-5928-8176-e4bb59153c51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48524 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "CVE-2026-48525", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:26a9ac72-c359-582c-a6ed-4df25db51c2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post5+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "code_not_present" } }, { "id": "CVE-2026-48526", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1c2ff1ed-ac48-5c24-8f93-a50f2c3ca285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post5+tuxcare of pyjwt." } }, { "id": "GHSA-pxh4-856f-4h89", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:0c4b4703-f56a-5017-bcb5-d43d40faf341", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post5+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "justification": "protected_at_runtime" } } ], "dependencies": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } ] }