zscaler-sdk-python 1.8.4__tar.gz → 1.8.5__tar.gz

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.8.4
+Version: 1.8.5
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT
@@ -26,9 +26,9 @@ Requires-Dist: arrow (>=1.3.0)
 Requires-Dist: cryptography (>=45.0.2)
 Requires-Dist: flatdict (>=4.0.0)
 Requires-Dist: pydash (>=8.0.3)
-Requires-Dist: pyjwt (>=2.8.0)
 Requires-Dist: python-box (>=7.3.0)
 Requires-Dist: python-dateutil (>=2.9.0)
+Requires-Dist: python-jose[cryptography] (>=3.3.0)
 Requires-Dist: pytz (>=2024.2)
 Requires-Dist: pyyaml (>=6.0.0)
 Requires-Dist: requests (>=2.32.3)

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.8.4"
+version = "1.8.5"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"
@@ -36,7 +36,7 @@ pytz = ">=2024.2"
 python-box = ">=7.3.0"
 python-dateutil = ">=2.9.0"
 flatdict = ">=4.0.0"
-pyjwt = ">=2.8.0"
+python-jose = {extras = ["cryptography"], version = ">=3.3.0"}
 aenum = ">=3.1.11"
 pydash = ">=8.0.3"
 arrow = ">=1.3.0"

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.5}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.8.4"
+__version__ = "1.8.5"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.5}/zscaler/oneapi_oauth_client.py

@@ -1,16 +1,52 @@
 import logging
 import json
 import requests
-import jwt
+from jose import jwt
 import time
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from zscaler.user_agent import UserAgent
 from zscaler.oneapi_http_client import HTTPClient
 from zscaler.errors.response_checker import check_response_for_error
 
 logger = logging.getLogger(__name__)
 
+# Security constants for key validation
+MIN_RSA_KEY_SIZE = 2048  # NIST recommends minimum 2048 bits for RSA keys
+
+
+def validate_rsa_key_strength(private_key_obj):
+    """
+    Validate that an RSA private key meets minimum security requirements.
+    
+    This addresses CWE-326 (Inadequate Encryption Strength) by ensuring
+    RSA keys meet NIST recommendations of at least 2048 bits.
+    
+    Args:
+        private_key_obj: RSA private key object from cryptography library
+        
+    Raises:
+        ValueError: If the key size is below the minimum requirement
+        
+    Returns:
+        int: The key size in bits
+    """
+    if isinstance(private_key_obj, rsa.RSAPrivateKey):
+        key_size = private_key_obj.key_size
+        if key_size < MIN_RSA_KEY_SIZE:
+            logger.error(f"RSA key size ({key_size} bits) is below minimum requirement ({MIN_RSA_KEY_SIZE} bits)")
+            raise ValueError(
+                f"Insufficient RSA key strength: {key_size} bits. "
+                f"Minimum required: {MIN_RSA_KEY_SIZE} bits (NIST recommendation). "
+                f"Please use a stronger RSA key to ensure secure authentication."
+            )
+        logger.debug(f"RSA key validation passed: {key_size} bits")
+        return key_size
+    else:
+        logger.warning(f"Key validation skipped: Unsupported key type {type(private_key_obj)}")
+        return None
+
 
 class OAuth:
     """
@@ -280,6 +316,9 @@ class OAuth:
             with open(private_key, "rb") as key_file:
                 private_key_obj = serialization.load_pem_private_key(key_file.read(), password=None, backend=default_backend())
 
+        # **Validate key strength to mitigate CWE-326 (Inadequate Encryption Strength)**
+        validate_rsa_key_strength(private_key_obj)
+
         # **Step 2: Create JWT for Client Assertion**
         now = int(time.time())
         payload = {