PT-2024-4196 · Pypi+2 · Python-Jose+2

Emmharnuherl01 · Published 2024-04-25 · Updated 2024-09-05 · CVE-2024-33664

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:L/Au:M/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions python-jose versions 3.3.0 and earlier

Description The issue is related to high resource consumption during the decoding of a crafted JSON Web Encryption (JWE) token, which can be exploited by a remote attacker to cause a denial of service. This is also known as a "JWT bomb" due to the high compression ratio of the token.

Recommendations For python-jose versions 3.3.0 and earlier, as a temporary workaround, consider restricting the use of the JWE token decoding function until a patch is available. Avoid using the decode function with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-04682

CVE-2024-33664

ECHO-BCFA-BE1B-CAFD

GHSA-CJWG-QFPM-7377

OPENSUSE-SU-2024:0149-1

OPENSUSE-SU-2024:13928-1

PYSEC-2024-233

Affected Products

Debian

Red Os

Python-Jose

References · 26

• 🔥 https://vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664 · Exploit
• https://github.com/mpdavis/python-jose/issues/344 · Vendor Advisory
• https://github.com/mpdavis/python-jose/pull/345 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:0149-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-33664 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-33664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33664 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13928-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-33664 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-233 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-33664 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjwg-qfpm-7377 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04682 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-33664 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-33664 · Vendor Advisory