{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "python3-jwt"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "python3-jwt",
                "from_version": {
                    "source_package_name": "pyjwt",
                    "source_package_version": "2.13.0-1",
                    "version": "2.13.0-1"
                },
                "to_version": {
                    "source_package_name": "pyjwt",
                    "source_package_version": "2.13.0-1ubuntu1",
                    "version": "2.13.0-1ubuntu1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-102266",
                        "url": "https://ubuntu.com/security/CVE-2026-102266",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102267",
                        "url": "https://ubuntu.com/security/CVE-2026-102267",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102268",
                        "url": "https://ubuntu.com/security/CVE-2026-102268",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102271",
                        "url": "https://ubuntu.com/security/CVE-2026-102271",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102272",
                        "url": "https://ubuntu.com/security/CVE-2026-102272",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102273",
                        "url": "https://ubuntu.com/security/CVE-2026-102273",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-102266",
                                "url": "https://ubuntu.com/security/CVE-2026-102266",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102267",
                                "url": "https://ubuntu.com/security/CVE-2026-102267",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102268",
                                "url": "https://ubuntu.com/security/CVE-2026-102268",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102271",
                                "url": "https://ubuntu.com/security/CVE-2026-102271",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102272",
                                "url": "https://ubuntu.com/security/CVE-2026-102272",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102273",
                                "url": "https://ubuntu.com/security/CVE-2026-102273",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Inconsistent HMAC key validation in HMACAlgorithm",
                            "    - debian/patches/CVE-2026-102266.patch: Validate PyJWK HMAC keys",
                            "      consistently in jwt/api_jws.py, tests/test_api_jws.py.",
                            "    - CVE-2026-102266",
                            "  * SECURITY UPDATE: Unvalidated HTTP redirect traversal in PyJWKClient",
                            "    - debian/patches/CVE-2026-102267.patch: Reject redirects in PyJWKClient",
                            "      fetches in jwt/jwks_client.py, tests/test_jwks_client.py.",
                            "    - CVE-2026-102267",
                            "  * SECURITY UPDATE: Algorithm confusion via whitespace and line-break evasion",
                            "    in is_pem_format",
                            "    - debian/patches/CVE-2026-102268.patch: fix: reject loader-accepted PEM",
                            "      variants in jwt/utils.py, tests/test_algorithms.py.",
                            "    - CVE-2026-102268",
                            "  * SECURITY UPDATE: Algorithm confusion via DER-encoded public key bytes in ",
                            "    HMACAlgorithm.prepare_key",
                            "    - debian/patches/CVE-2026-102271.patch: fix: reject DER public keys as ",
                            "      HMAC secrets in jwt/algorithms.py, tests/test_algorithms.py.",
                            "    - CVE-2026-102271",
                            "  * SECURITY UPDATE: Key inspection bypass via UTF-8 Byte Order Mark (BOM) in",
                            "    HMACAlgorithm.prepare_key",
                            "    - debian/patches/CVE-2026-102272.patch: Reject encoded JWKs as HMAC keys",
                            "      in jwt/algorithms.py, tests/test_algorithms.py.",
                            "    - CVE-2026-102272",
                            "  * SECURITY UPDATE: Key-type spoofing via nested JWK container structures in ",
                            "    HMACAlgorithm.prepare_key",
                            "    - debian/patches/CVE-2026-102273.patch: fix: reject public JWK container",
                            "      HMAC keys in jwt/algorithms.py, tests/test_algorithms.py.",
                            "    - CVE-2026-102273",
                            ""
                        ],
                        "package": "pyjwt",
                        "version": "2.13.0-1ubuntu1",
                        "urgency": "medium",
                        "distributions": "stonking",
                        "launchpad_bugs_fixed": [],
                        "author": "Hurman <hurman@canonical.com>",
                        "date": "Thu, 08 Oct 2026 14:52:39 +0800"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 26.10 stonking image from daily image serial 20261011 to 20261019",
    "from_series": "stonking",
    "to_series": "stonking",
    "from_serial": "20261011",
    "to_serial": "20261019",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}