QID 750667

This update for python-pyjwt fixes the following issues: python-jwt was updated to 1.5.3. (
Bsc#1186173) update to version 1.5.3: * changed + increase required version of the cryptography package to >=1.4.0.
* fixed + remove uses of deprecated functions from the cryptography package.
+ warn about missing algorithms param to decode() only when verify param is true #281 update to version 1.5.2: - ensure correct arguments order in decode super call [7c1e61d][7c1e61d] - change optparse for argparse. [#
238][238] - guard against pkcs1 pem encododed public keys [#277][277] - add deprecation warning when decoding without specifying `algorithms` [#277][277] - improve deprecation messages [#270][270] - pyjwt.decode: move verify param into options [#271][271] - support for python 3.6 [#262][262] - expose jwt.
Invalidalgorithmerror [#264][264] - add support for ecdsa public keys in rfc 4253 (openssh) format [#244][244] - renamed commandline script `jwt` to `jwt-cli` to avoid issues with the script clobbering the `jwt` module in some circumstances. [#
187][187] - better error messages when using an algorithm that requires the cryptography package, but it isn't available [#230][230] - tokens with future 'iat' values are no longer rejected [#190][190] - non-numeric 'iat' values now raise invalidissuedaterror instead of decodeerror - remove rejection of future 'iat' claims [#252][252] - add back 'es512' for backward compatibility (for now) [#225][225] - fix incorrectly named ecdsa algorithm [#219][219] - fix rpm build [#196][196] - add jwk support for hmac and rsa keys [#202][202]

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation allows attacker to compromise the system.