GoogleCloudPlatform / GoogleCloudPlatform/getting-started-python

Replace python-jose dependency

Open
#565 2 comments 1 reaction 0 assignees View on GitHub
priority: p1 type: cleanup
Dominant language
Python
Stars
819
Forks
571
PR merge metrics
No merged PRs in 30d

Description

A vulnerability has been found in the `ecdsa` dependency which will not be patched in the `python-jose` package. `python-jose` [seems to be abandoned](https://github.com/mpdavis/python-jose/issues/332). Other people are also encountering these [security issues](https://github.com/mpdavis/python-jose/issues/341).

I suggest to update [authenticating-users/main.py](https://github.com/GoogleCloudPlatform/getting-started-python/blob/main/authenticating-users/main.py) to not use this insecure package. A commonly used alternative is PyJWT.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.