GoogleCloudPlatform / GoogleCloudPlatform/getting-started-python

Replace python-jose dependency

未關閉
#565 2 則留言 1 個 reaction 已指派 0 人 在 GitHub 檢視
priority: p1 type: cleanup
主要語言
Python
星號
819
分支
571
PR 合併指標
30 天內沒有已合併 PR

描述

A vulnerability has been found in the `ecdsa` dependency which will not be patched in the `python-jose` package. `python-jose` [seems to be abandoned](https://github.com/mpdavis/python-jose/issues/332). Other people are also encountering these [security issues](https://github.com/mpdavis/python-jose/issues/341).

I suggest to update [authenticating-users/main.py](https://github.com/GoogleCloudPlatform/getting-started-python/blob/main/authenticating-users/main.py) to not use this insecure package. A commonly used alternative is PyJWT.

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。