CVE-2024-33664

Advisory

Affected versions of Python-jose allow attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319. See CVE-2024-33664.


MISC:https://github.com/mpdavis/python-jose/issues/344: https://github.com/mpdavis/python-jose/issues/344
MISC:https://github.com/mpdavis/python-jose/pull/345: https://github.com/mpdavis/python-jose/pull/345

Resources

• https://github.com/mpdavis/python-jose/issues/344
• https://github.com/mpdavis/python-jose/pull/345
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33664