Replace python-jose

[ammar92]

Is your feature request related to a problem? Please describe.
As noticed by @underdarknl, the python-jose package used within Bytes for authentication is currently unmaintained and vulnerable.

Describe the solution you'd like
We should replace the package. There are some more active packages such as python-jwt and pyjwt that could be used.

Describe alternatives you've considered
We could consider an alternative authentication mechanism that works for every service in OpenKAT. Besides the databases, currently only Rocky and Bytes have strict authentication support.

[milliesolem]

Hello,

I would strongly recommend going for PyJWT. It is as far as I've tested the most thoroughly secured Python implementation of JWT/rfc7519 out there.

The CVE-2024-33663 vulnerability mentioned only affects packages utilizing asymmetric signing and verification with python-jose when the algorithm field is not specified. Bytes uses HS256 (hash-based symmetric signing/MAC) which means it is not affected by the vulnerability. However, python-jose is unmaintained and should be replaced anyways.

Kind regards,
Millie

[underdarknl]

dear @milliesolem thanks for reaching out, and thanks for taking the time to look for bugs like these in packages.

The main reason we want to move away from python-jose is indeed the apparent lack of maintenance, and this CVE provides a good reminder of my unmaintained packages are risky. It also gives the author a change to come forward with a plan of action when it is most needed, which I have not seen at this moment. So, migrate it is.