PT-2024-2083 · Jwcrypto+6 · Jwcrypto+6

P3Ngu1Nw · Published 2024-03-06 · Updated 2025-12-22 · CVE-2024-28102

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions jwcrypto versions prior to 1.5.6

Description The issue is related to an uncontrolled resource consumption in the jwcrypto library. An attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time.

Recommendations For versions prior to 1.5.6, to mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. As a temporary workaround, consider restricting the processing of tokens with high compression ratios until a patch is available. Update to version 1.5.6 or later to fix the vulnerability.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALSA-2024:2559

ALSA-2024_2559

AZL-43360

AZL-43366

BDU:2024-01978

CESA-2024_3267

CVE-2024-28102

DLA-3883-1

GHSA-J857-7RVV-VJ97

INFSA-2024_2559

INFSA-2024_3267

OESA-2024-2443

OESA-2024-2444

OESA-2025-1163

OPENSUSE-SU-2024:13798-1

RHSA-2024:2559

RHSA-2024:3267

RHSA-2024:4522

RHSA-2024_2559

RHSA-2024_3267

RLSA-2024:2559

RLSA-2024:3267

Affected Products

Almalinux

Astra Linux

Centos

Red Hat

Red Os

Rocky Linux

Jwcrypto

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28102.json · Exploit
• 🔥 https://vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103 · Exploit
• https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97 · Vendor Advisory
• https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f · Patch
• https://linux.oracle.com/errata/ELSA-2024-3267.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28102 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-2559.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3102 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2444 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:3267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28102 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-28102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01978 · Security Note