Open
fix CVE-2026-48526 #51
lipengyu001Add on Jul 23
fix CVE-2026-48526 #51
Open
Merge blocked
Jul 23 Created pull request, commit 494a82a9
Jul 23 Associated issue: CVE-2026-48526
Jul 23 Set licihua,dillon_chen,overweight,zhujianwei001,shenyangyang as approver
Jul 23 Added label: sig/Base-service
openeuler-ci-bot
Jul 23 Comments：
Jul 23 Comments：
Welcome To openEuler Community
Hey @lipengyu001 , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.
Contact Guide
If you have any questions, please contact the SIG: Base-service ,
and any of the maintainers: @dillon_chen, @licihua, @overweight, @shenyangyang, @zhujianwei001 ,
and any of the committers: @yangyuan32, @zhuchunyi .
60 messages are collapsed here。 See more
Sep 23 Removed label: ci_processing
openeuler-ci-bot
Sep 23 Comments：
Sep 23 Comments：
| Check Name | Build Result | 详情 | Build Details | |
|---|---|---|---|---|
| check_binary_file | ✅SUCCESS | #24 | ||
| check_lfsconfig | ☑EXCLUDE | |||
| check_package_yaml_file | ✅SUCCESS | |||
| check_repo_in_maintain | ✅SUCCESS | |||
| check_consistency | ✅SUCCESS | |||
| check_spec_file | ✅SUCCESS | |||
| x86_64 | check_build | ✅SUCCESS | #24 | |
| check_install | ✅SUCCESS | |||
| check_license | ✅SUCCESS | |||
| aarch64 | check_build | ✅SUCCESS | #24 | |
| check_install | ✅SUCCESS | |||
| check_license | ✅SUCCESS | |||
Sep 23 Added label: ci_successful
openeuler-ci-bot
Sep 23 Comments：
Sep 23 Comments：
如下为接口变更检查结果，目标分支为openEuler-24.03-LTS-SP4，请PR提交者check差异信息
| Arch Name | Check Items | Rpm Name | Check Result | Build Details |
|---|---|---|---|---|
| compare_package(x86_64) | add_rpms | ✅SUCCESS | #24 | |
| delete_rpms | ✅SUCCESS | |||
| rpm_files | ✅SUCCESS | |||
| rpm_provides | ✅SUCCESS | |||
| rpm_requires | ✅SUCCESS | |||
| compare_package(aarch64) | add_rpms | ✅SUCCESS | #24 | |
| delete_rpms | ✅SUCCESS | |||
| rpm_files | ✅SUCCESS | |||
| rpm_provides | ✅SUCCESS | |||
| rpm_requires | ✅SUCCESS |
openeuler-ci-bot
Sep 23 Comments：
Sep 23 Comments：
当前PR是否有AI参与:
[x] 否
[ ] Yes
__1. AI Agent 平台:
__2. AI 模型 :
__3. Prompt 上下文 :
参考：openEuler社区《生成式AI工具使用与开源贡献政策》
PR功能描述 / 为什么需要这个合入**:
问题原因： PyJWT 在 HMAC 算法路径中只拒绝 PEM/SSH 形式的非对称密钥，但没有识别 raw JSON JWK，因此在应用同时允许 HS* 和 RS*/ES*/OKP 等混合算法、并把公钥 JWK JSON 字符串直接作为 key 传入时，攻击者可将 token 头部改为 HS*，让公钥 JWK 文本被当作 HMAC secret 使用，从而伪造签名。
修复方法：在 HMACAlgorithm.prepare_key() 中增加 JWK 形态检测：将 key转为 bytes 后去除前导空白，若看起来是 JSON 对象则解析，解析结果为 dict 且包含 JWK 必备字段 "kty" 时直接抛出InvalidKeyError，要求使用 PyJWK 或 HMACAlgorithm.from_jwk() 正确加载 JWK，而不是把 JWK JSON 当作 HMAC secret
该PR关联的issue
https://atomgit.com/src-openeuler/python-jwt/issues/27
希望检视人员了解:
上游所示补丁为多个cve修复逻辑还包括，cve-2026-48524 cve-2026-48522 cve-2026-48524,本pr在里面仅抽取出cve-2026-48526的修复逻辑，其中jwt/algorithms.py的修复逻辑：
if len(key_bytes) == 0: raise InvalidKeyError("HMAC key must not be empty.")解决的是 “空 HMAC 密钥仍被接受”的问题。也不属于该cve的修复