Visitar URL original
Replace python-jose dependency · Issue #565 · GoogleCloudPlatform/getting-started-python · GitHub
Skip to content

Replace python-jose dependency #565

Open
#566
Open
Replace python-jose dependency#565
#566
Labels
priority: p1Important issue which blocks shipping the next release. Will be fixed prior to next release.type: cleanupAn internal cleanup or hygiene concern.

Description

@Jipje
Jipje
opened on May 2, 2024

A vulnerability has been found in the ecdsa dependency which will not be patched in the python-jose package. python-jose seems to be abandoned. Other people are also encountering these security issues.

I suggest to update authenticating-users/main.py to not use this insecure package. A commonly used alternative is PyJWT.

Activity

  1. Jipje commented on May 2, 2024

    @Jipje
    Jipje
    on May 2, 2024
    Author

    Further searching also shows that GoogleCloudPlatform/python-docs-samples/iap/validate_jwt.py could contain a potential solution

  2. vchudnov-g
    added
    type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.
    priority: p1Important issue which blocks shipping the next release. Will be fixed prior to next release.
    on May 20, 2024

  3. vchudnov-g commented on May 20, 2024

    @vchudnov-g
    vchudnov-g
    on May 20, 2024

    Thanks for reporting this issue! We'll address it promptly.

  4. iennae
    added
    type: cleanupAn internal cleanup or hygiene concern.
    and removed
    type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.
    on Jan 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    priority: p1Important issue which blocks shipping the next release. Will be fixed prior to next release.type: cleanupAn internal cleanup or hygiene concern.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions