python-jose denial of service via compressed JWE content

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-33664 · ADVISORY
• mpdavis/python-jose · WEB
• mpdavis/python-jose#345 · WEB
• mpdavis/python-jose · PACKAGE
• mpdavis/python-jose release 3.4.0 · WEB
• pypa/advisory-database · WEB
• vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664 · WEB
• GitHub Advisory GHSA-cjwg-qfpm-7377 · ADVISORY

python-jose のその他の脆弱性

• CVE-2024-29370中 5.3In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting…
• CVE-2024-33663中 6.5python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
• CVE-2016-7036緊急 9.8python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.