id: PYSEC-2020-40
details: 'An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers
  with access to a notionally invalidated token to obtain a new, working token via
  the refresh endpoint, because the blacklist protection mechanism is incompatible
  with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt,
  which is unmaintained.'
affected:
- package:
    name: drf-jwt
    ecosystem: PyPI
    purl: pkg:pypi/drf-jwt
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 1.15.0
    - fixed: 1.15.1
  versions:
  - 1.15.0
references:
- type: REPORT
  url: https://github.com/jpadilla/django-rest-framework-jwt/issues/484
- type: PACKAGE
  url: https://pypi.org/project/drf-jwt/1.15.1/#history
- type: REPORT
  url: https://github.com/Styria-Digital/django-rest-framework-jwt/issues/36
- type: ADVISORY
  url: https://github.com/advisories/GHSA-fpjm-rp2g-3r4c
aliases:
- CVE-2020-10594
- GHSA-fpjm-rp2g-3r4c
modified: '2020-03-19T17:38:00Z'
published: '2020-03-15T22:15:00Z'