Repository: mpdavis/python-jose

Issue:
CVE-2017-11424 Applies to python-jose as well!
[CVE-2017-11424](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11424) details a key confusion attack against pyjwt.

As I understand it, we just need to add another magic string to [this check](https://github.com/mpdavis/python-jose/blob/b54c12aa54b76d34942f537418399d689d828099/jose/jwk.py#L106-L115)

Not being a crypto expert, I'll open a pull request with the fix described in the CVE, but would appreciate someone else taking a look at the CVE before merging.

Discussion:

Patch:
diff --git a/.travis.yml b/.travis.yml
index 5f5a814..92102f6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,4 +1,7 @@
 sudo: false
+# Travis infra requires pinning dist:precise, at least as of 2017-09-01
+# detail: https://blog.travis-ci.com/2017-06-21-trusty-updates-2017-Q2-launch
+dist: precise
 language: python
 python:
   - "2.6"
diff --git a/jose/jwk.py b/jose/jwk.py
index 03a318d..0ae8b05 100644
--- a/jose/jwk.py
+++ b/jose/jwk.py
@@ -105,6 +105,7 @@ class HMACKey(Key):
 
         invalid_strings = [
             b'-----BEGIN PUBLIC KEY-----',
+            b'-----BEGIN RSA PUBLIC KEY-----',
             b'-----BEGIN CERTIFICATE-----',
             b'ssh-rsa'
         ]


Test patch:
diff --git a/tests/algorithms/test_HMAC.py b/tests/algorithms/test_HMAC.py
index 30e2714..e84c2c0 100644
--- a/tests/algorithms/test_HMAC.py
+++ b/tests/algorithms/test_HMAC.py
@@ -17,6 +17,10 @@ class TestHMACAlgorithm:
         with pytest.raises(JOSEError):
             HMACKey(key, ALGORITHMS.HS256)
 
+        key = "-----BEGIN RSA PUBLIC KEY-----"
+        with pytest.raises(JOSEError):
+            HMACKey(key, ALGORITHMS.HS256)
+
         key = "-----BEGIN CERTIFICATE-----"
         with pytest.raises(JOSEError):
             HMACKey(key, ALGORITHMS.HS256)