PT-2024-4195 · Unknown+2 · Python-Jose+2

Emmharnuherl · Published 2024-04-25 · Updated 2024-09-03 · CVE-2024-33663

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-jose versions 3.3.0 and earlier

Description The issue is related to algorithm confusion with OpenSSH ECDSA keys and other key formats in the python-jose component. It is associated with the definition of a prefix blacklist for OpenSSH ECDSA public keys. Exploitation of this issue may allow a remote attacker to gain unauthorized access to OpenSSH ECDSA public keys.

Recommendations For python-jose versions 3.3.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

BDU:2024-04681

CVE-2024-33663

ECHO-04E0-8CCC-E285

GHSA-6C5P-J8VQ-PQHJ

OPENSUSE-SU-2024:0118-1

OPENSUSE-SU-2024:13928-1

PYSEC-2024-232

RHSA-2024:6428

Affected Products

Debian

Red Os

Python-Jose

References · 27

• 🔥 https://vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663 · Exploit
• https://github.com/mpdavis/python-jose/issues/346 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-33663 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04681 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-232 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13928-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33663 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-33663 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-33663 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6c5p-j8vq-pqhj · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-33663 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-33663 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-33663 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0118-1 · Vendor Advisory
• https://github.com/mpdavis/python-jose · Note