CVE-2024-28102

Aliases:GHSA-j857-7rvv-vj97
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 06 Mar 2024, 21:09
Last modified:09 Sept 2024, 13:06

Vulnerability Summary

Overall Risk (default)
medium
37/100
CVSS Score
6.8 MEDIUM
v3.1 (cve.org)
EPSS Score
0.38% LOW
0% probability +0.10%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

06 Mar 2024, 21:09
Published
Vulnerability first disclosed
09 Sept 2024, 13:06
Last Modified
Vulnerability information updated

Description

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.38%• Percentile: 60%

Techniques & Countermeasures

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • debian•debian_linux

    11.0

  • latchset•jwcrypto

    < 1.5.6

  • PyPI•jwcrypto

    < 1.5.6

References (6)