Duplicate Advisory: python-jose denial of service via compressed JWE content

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2024-29370 · ADVISORY
• mpdavis/python-jose · WEB
• mpdavis/python-jose commit 483529e · WEB
• mpdavis/python-jose release 3.4.0 · WEB
• pypa/advisory-database · WEB
• GitHub Advisory GHSA-h4pw-wxh7-4vjj · ADVISORY

Lỗ hổng khác của python-jose

• CVE-2024-33664TRUNG BÌNH 5.3python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryp…
• CVE-2024-33663TRUNG BÌNH 6.5python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
• CVE-2016-7036NGHIÊM TRỌNG 9.8python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.