rpm package
opensuse/python-python-jose&distro=openSUSE Leap 15.5
pkg:rpm/opensuse/python-python-jose&distro=openSUSE%20Leap%2015.5
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-33664 | — | < 3.0.1-bp155.3.6.1 | 3.0.1-bp155.3.6.1 | Apr 25, 2024 | python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319. | ||
| CVE-2024-33663 | — | < 3.0.1-bp155.3.3.1 | 3.0.1-bp155.3.3.1 | Apr 25, 2024 | python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217. |
- CVE-2024-33664Apr 25, 2024affected < 3.0.1-bp155.3.6.1fixed 3.0.1-bp155.3.6.1
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
- CVE-2024-33663Apr 25, 2024affected < 3.0.1-bp155.3.3.1fixed 3.0.1-bp155.3.3.1
python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.