Vulnerability with python-jose

[TaylorNQT]

There is currently an issue with the python-jose package as described here.

Potential fix is to replace with PyJWT.

[pamelafox]

cc @mattgotteiner

It looks like our usage should not be affected by the vulnerability, since we do specify an algorithm:

azure-search-openai-demo/app/backend/core/authentication.py

Line 343 in 3822c52

jwt.decode(token, rsa_key, algorithms=["RS256"], audience=audience, issuer=issuer)

Let me know if you think otherwise.

We're also aware that python-jose is generally unmaintained, but last I checked, pyJWT was still missing a feature that we needed to be able to move over to it. Happy to be corrected if it's a suitable substitute now.

Thanks so much for filing.

[TaylorNQT]

That's OK, I just wanted to make you aware :)