Duplicate Advisory: python-jose denial of service via compressed JWE content
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references. ### Original Description In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-29370US | — | — | ||
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) t… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/mpdavis/python-jose/commit/483529ee93a3ab510ab579d4d4cc644dba926adeWEB
- https://github.com/mpdavis/python-jose/issues/344WEB
- https://github.com/mpdavis/python-jose/releases/tag/3.4.0WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2025-185.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-29370ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan