Fix for GHSA-gg9x-qcx2-xmrh#190
Merged
Merged
Conversation
…empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Larry-Osakwe
pushed a commit
that referenced
this pull request
Jul 19, 2026
This PR promotes joserfc to a first-class dependency, so it must not ship on a vulnerable floor. joserfc 1.6.4 is affected by: - GHSA-gg9x-qcx2-xmrh (HIGH): HS256/384/512 verify accepts empty/nil HMAC key - GHSA-wphv-vfrh-23q5 (MODERATE): b64=false RFC7797 JWS payload-size bypass 1.6.8 fixes both (superset of the two Socket bot PRs #189/#190, which target 1.6.7 and 1.6.8). Root uv.lock resolves to 1.6.8; tests pass. Neither advisory affects our own code path (we verify RS256), but a correct floor matters for downstream consumers.
Larry-Osakwe
approved these changes
Jul 20, 2026
Larry-Osakwe
added a commit
that referenced
this pull request
Jul 20, 2026
…195) * fix(keycardai-oauth): migrate JOSE handling from authlib to joserfc authlib.jose is deprecated and emits an AuthlibDeprecationWarning on import, surfacing to every SDK user. Migrate JWT signing/verification and JWK handling to joserfc (authlib 's recommended replacement, already in the dependency tree). - decode_and_verify_jwt: import key via joserfc, decode with explicit algorithms, return .claims - get_jwks_key: return import_key(jwk).as_pem() - create_client_assertion / key export: joserfc encode + import_key - derive key type from the JWS algorithm so PEM imports do not emit joserfc's implicit-key SecurityWarning - drop the direct authlib dependency (remains transitively via fastmcp) * fix(keycardai-oauth): reject unknown JWT algorithms; minimize lockfile diff Address review feedback on the joserfc migration: - _key_type_for_algorithm now raises on an unrecognized algorithm instead of silently defaulting to RSA (a genuine mismatch previously failed later at key import / the algorithms=[...] gate; now it fails explicitly). - Hand-restore uv.lock to a minimal authlib->joserfc swap. Regenerating under a newer uv had added unrelated python_full_version markers to transitive deps (aiologic, onnxruntime deps, sympy). joserfc was already present transitively, so only the oauth entry changes. Verified consistent with uv sync --frozen. * fix(keycardai-oauth): pin joserfc>=1.6.8 to clear GHSA advisories This PR promotes joserfc to a first-class dependency, so it must not ship on a vulnerable floor. joserfc 1.6.4 is affected by: - GHSA-gg9x-qcx2-xmrh (HIGH): HS256/384/512 verify accepts empty/nil HMAC key - GHSA-wphv-vfrh-23q5 (MODERATE): b64=false RFC7797 JWS payload-size bypass 1.6.8 fixes both (superset of the two Socket bot PRs #189/#190, which target 1.6.7 and 1.6.8). Root uv.lock resolves to 1.6.8; tests pass. Neither advisory affects our own code path (we verify RS256), but a correct floor matters for downstream consumers. --------- Co-authored-by: GitHub Action <action@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Socket fix for GHSA-gg9x-qcx2-xmrh.
Vulnerability Summary: joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Severity: HIGH
Affected Packages: joserfc (PIP)