CVE-2024-33664

Опубликовано: 26 апр. 2024

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

Ссылки

https://github.com/mpdavis/python-jose/issues/344
Exploit
Issue Tracking
Mitigation
Vendor Advisory
https://github.com/mpdavis/python-jose/pull/345
Issue Tracking
Patch
https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
Exploit
Mitigation
Third Party Advisory
https://github.com/mpdavis/python-jose/issues/344
Exploit
Issue Tracking
Mitigation
Vendor Advisory
https://github.com/mpdavis/python-jose/pull/345
Issue Tracking
Patch
https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
Exploit
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:*

Версия до 3.3.0 (включая)

EPSS

Процентиль: 42%

0.00194

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVE-2024-33664

CVSS3: 5.3

ubuntu

больше 1 года назад

CVE-2024-33664

redhat

больше 1 года назад

CVE-2024-33664

CVSS3: 5.3

debian

больше 1 года назад

python-jose through 3.3.0 allows attackers to cause a denial of servic ...

openSUSE-SU-2024:0149-1

suse-cvrf

больше 1 года назад

Security update for python-python-jose

GHSA-cjwg-qfpm-7377

CVSS3: 5.3

github

больше 1 года назад

python-jose denial of service via compressed JWE content

EPSS

Процентиль: 42%

0.00194

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-400