-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 31 Jul 2026 10:59:30 +0200
Source: python-authlib
Architecture: source
Version: 1.2.0-1+deb12u2
Distribution: bookworm
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Changes:
python-authlib (1.2.0-1+deb12u2) bookworm; urgency=medium
.
* Non-maintainer upload by the Debian LTS team.
* Add patches for security issue:
- CVE-2026-44681: Always unvalidate redirect URI when raisung
InvalidScopeError in OIDC grants.
- CVE-2026-27962: Fix authentication and authorization bypass
vulnerability by embedding a crafted public key in the jwk
header field when key=None is passed to JWS deserialization
functions.
- CVE-2026-28490: Authlib exposed distinguishable error responses
between invalid PKCS#1 v1.5 padding and invalid AES-GCM tag,
enabling Bleichenbacher-style attacks.
- CVE-2026-28498: Fix OIDC ID Token validation bypass in at_hash
and c_hash verification. _verify_hash() silently returned True
when create_half_hash() received an unknown algorithm, allowing
forged ID Tokens to pass validation.
- CVE-2026-41425: Add CSRF protection also when using the cache
feature in authlib.integrations.starlette_client.OAuth.
Checksums-Sha1:
6be031ff7c5bfbd06750408f3858563ef30ef09f 2091 python-authlib_1.2.0-1+deb12u2.dsc
0df1f58faf6ac1a4429c111350eda2ffb4cf2cfd 307961 python-authlib_1.2.0.orig.tar.gz
cfcf1b671244a142c702a09668cd5e7ddaed5f71 16056 python-authlib_1.2.0-1+deb12u2.debian.tar.xz
781d620517ee5c3defba79b1e3d075e43efc666d 8216 python-authlib_1.2.0-1+deb12u2_source.buildinfo
Checksums-Sha256:
334ccd112e112e0abaf00a30ae83414bf367d335a2654bcc6face46518d94e44 2091 python-authlib_1.2.0-1+deb12u2.dsc
049a3850f3c6d0dfa1b9cdcc6527aac7bcc7b1813c6829c6351dacf30c9975e4 307961 python-authlib_1.2.0.orig.tar.gz
603d5500bac52fb9de056d265c9bfa3baaed3fda24b0dd63f1b27deb9b7a5648 16056 python-authlib_1.2.0-1+deb12u2.debian.tar.xz
18664356c7947ac78f5ed0bef567faef1f9ebd0b1e1a0ab2852ec8fa72f1f46a 8216 python-authlib_1.2.0-1+deb12u2_source.buildinfo
Files:
91cdc06e8f3181f92c166353b93a5292 2091 python optional python-authlib_1.2.0-1+deb12u2.dsc
14c0b905db007442c1acee1bac3f0f1d 307961 python optional python-authlib_1.2.0.orig.tar.gz
0c4fa70f866bae6bef8571a2064df8cf 16056 python optional python-authlib_1.2.0-1+deb12u2.debian.tar.xz
4b833a054934377ac8dfd2c19c68dc03 8216 python optional python-authlib_1.2.0-1+deb12u2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCamyHxgAKCRDoRGtKyMdy
YfRaAP9VEmnI2rRtQwcGodhyKRN3dK4dtSsEZQRjx2kVxobGEgD9E7TRllg/1OQV
rw8eVqSfUA7epiWR0aLc4bhr9tuWYwA=
=0ZrQ
-----END PGP SIGNATURE-----
