pyJWT vulnerability
udpdate pyJWT to version 2.4.0 (currently 2.1.0) due to security issue. See : https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24
Additional information: The vulnerability is around the usage of method get_default_algorithm. Inside Wellbore Domain Services, there are 3 identified usages of PyJWT lib and none of them use the faulty method:
- osdu-core-lib-python-gcp: the algorithm is fixed to RS256.
- msal, Microsoft authentication library. No usage of get_default_algorithm inside, the algorithm is explicitly requested, (if none, it will used HS256).
- adal, Azure active directory authentication (meant to be replaced by msal), from adlfs: Algorithm is fixed to RS256.
Edited by Yannick