CVE-2024-33664

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-33664

CGA ID

CGA-ppg8-8mf4-23m5

Severity

5.3

Medium

CVSS V3

Summary

python-jose denial of service via compressed JWE content

Description

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

References

https://images.chainguard.dev/security/CGA-ppg8-8mf4-23m5
https://github.com/advisories/GHSA-cjwg-qfpm-7377
https://nvd.nist.gov/vuln/detail/CVE-2024-33664
https://github.com/mpdavis/python-jose/issues/344
https://github.com/mpdavis/python-jose/pull/345
https://github.com/mpdavis/python-jose
https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CVE-2024-33664

Severity

Summary

Description

References

Affected packages

Product

Why Chainguard

Customers

Company

Resources