Compare commits

..
2 Commits
Author SHA1 Message Date
twothatITandClaude Sonnet 5 419598220a chore(release): bump version to 1.6.2
Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-10-20 08:47:40 +02:00
twothatITandClaude Sonnet 5 565dc5f710 fix(auth): replace unmaintained python-jose with PyJWT
Dependabot alert #25 (python-jose algorithm confusion guard bypassed by
DER-encoded public keys, CVE-2026-85394, Critical) has no patched version
of python-jose available at all - it's affected through the latest
release 3.5.0. python-jose was only used in app/dependencies.py for plain
HS256 JWT encode/decode with our own symmetric SECRET_KEY (algorithms=[...]
was already explicitly restricted on every decode call, so the specific
RS256/HS256 confusion path didn't apply here), but staying on an
unmaintained library that keeps generating unfixable critical alerts isn't
sustainable.

Swapped to PyJWT, which is actively maintained, already pulled in
transitively via msal, and a near drop-in replacement for this app's
encode()/decode() usage. Verified with a Docker build and in-container
token create/verify/reject round-trip.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-10-20 08:47:33 +02:00
3 changed files with 6 additions and 5 deletions
+4 -3
View File
@@ -3,9 +3,10 @@
from datetime import datetime, timedelta
from typing import Optional
import jwt
from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
from jose import JWTError, jwt
from jwt import PyJWTError
from sqlalchemy.orm import Session
from app.database import get_db
@@ -56,7 +57,7 @@ def verify_mfa_token(token: str) -> str:
detail="Invalid MFA token.",
)
return username
except JWTError:
except PyJWTError:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="MFA token expired or invalid.",
@@ -95,7 +96,7 @@ def get_current_user(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Invalid token payload.",
)
except JWTError:
except PyJWTError:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,
detail="Invalid or expired token.",
+1 -1
View File
@@ -34,7 +34,7 @@ logger = logging.getLogger(__name__)
app = FastAPI(
title="NetBird MSP Appliance",
description="Multi-tenant NetBird management platform for MSPs",
version="1.6.1",
version="1.6.2",
docs_url="/api/docs",
redoc_url="/api/redoc",
openapi_url="/api/openapi.json",
+1 -1
View File
@@ -5,7 +5,7 @@ sqlalchemy==2.0.23
aiosqlite==0.19.0
pydantic==2.5.2
pydantic-settings==2.1.0
python-jose[cryptography]==3.4.0
PyJWT==2.15.1
passlib[bcrypt]==1.7.4
bcrypt==4.1.2
cryptography==50.0.0