Latest version of openwebui is using python-jose 3.3.0
PoC
look at requirements.txt or pyproject.toml
Impact
Security scans are blocking it
Originally created by @dmvieira on GitHub (Dec 2, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/7561
### Summary
This is a [critical severity security](https://vuldb.com/?id.262059) issue [opened here](https://github.com/mpdavis/python-jose/issues/346).
### Details
Latest version of openwebui is using python-jose 3.3.0
### PoC
look at requirements.txt or pyproject.toml
### Impact
Security scans are blocking it
I'm pretty sure it's not being used anywhere in the codebase. Confirmation wanted here!
<!-- gh-comment-id:2512632141 -->
@tjbck commented on GitHub (Dec 2, 2024):
I'm pretty sure it's not being used anywhere in the codebase. Confirmation wanted here!
Yes it's in the requirements, but I believe it's not being used. Confirmation wanted here.
<!-- gh-comment-id:2512687221 -->
@tjbck commented on GitHub (Dec 2, 2024):
Yes it's in the requirements, but I believe it's not being used. Confirmation wanted here.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @dmvieira on GitHub (Dec 2, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/7561
Summary
This is a critical severity security issue opened here.
Details
Latest version of openwebui is using python-jose 3.3.0
PoC
look at requirements.txt or pyproject.toml
Impact
Security scans are blocking it
@tjbck commented on GitHub (Dec 2, 2024):
I'm pretty sure it's not being used anywhere in the codebase. Confirmation wanted here!
@dmvieira commented on GitHub (Dec 2, 2024):
it's here: https://github.com/search?q=repo%3Aopen-webui%2Fopen-webui%20python-jose&type=code
@tjbck commented on GitHub (Dec 2, 2024):
Yes it's in the requirements, but I believe it's not being used. Confirmation wanted here.