Python Jose Project vulnerabilities
4 vulnerabilities
Known vulnerabilities in Python Jose Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Python Jose4 vulnerabilities
RoutineCVE-2024-29370python-jose_project · python-jose +3 morepython-jose_project python-joseIn python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.CVSS5.3MediumEPSS0.19%RoutineCVE-2024-33664python-jose_project · python-jose +5 morepython-jose_project python-josepython-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.CVSS5.3MediumEPSS0.78%RoutineCVE-2024-33663python-jose_project · python-jose +6 morepython-jose_project python-josepython-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.CVSS9.3CriticalEPSS0.31%PrioritiseCVE-2016-7036python-jose_project · python-jose +1 morepython-jose_project python-josepython-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.CVSS9.8CriticalEPSS2.17%