p PatchFirst

CVE-2024-29370

CVE-2024-29370

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

CVSS 5.3 · Medium · EPSS 0.2%

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-jose Debian:12

    Versions
    • 3.3.0+dfsg-4
    • 3.3.0+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-jose PyPI

    Versions
    • 0.1.0
    • 0.1.1
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.5
    • 0.1.6
    • 0.1.7
    • 0.1.8
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.5.5
    • 0.5.6
    • 0.6.1
    • 0.6.2
    • 0.7.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 3.0.0
    • 3.0.1
    • 3.1.0
    • 3.2.0
    • 3.3.0
    Affected ranges
    • ECOSYSTEM: ≤ 3.3.0

    No fix published

  • python-jose Ubuntu:22.04:LTS

    Versions
    • 3.3.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-jose Ubuntu:24.04:LTS

    Versions
    • 3.3.0+dfsg-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →