https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:14:34 +0000 https://cve.radiocsirt.org/vuln/brew-glances-cve-2024-33663 <p><strong>Affected:</strong> Homebrew: glances</p> <p>python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.</p> <p><strong>Affected:</strong> Homebrew: glances</p> <p>python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.</p> https://cve.radiocsirt.org/vuln/brew-glances-cve-2024-33663 https://cve.radiocsirt.org/vuln/euvd-2026-367871 EUVD-2026-367871 https://cve.radiocsirt.org/vuln/euvd-2026-367871 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85394 <p>python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service&#39;s public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.</p> <p>python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service&#39;s public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-85394 https://cve.radiocsirt.org/vuln/ghsa-3qf3-8w2g-rqmx <p>python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service&#39;s public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.</p> <p>python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service&#39;s public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.</p> https://cve.radiocsirt.org/vuln/ghsa-3qf3-8w2g-rqmx https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-85394 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python-jose, Ubuntu:24.04:LTS: python-jose</p> <p>python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service&#39;s public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python-jose, Ubuntu:24.04:LTS: python-jose</p> <p>python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service&#39;s public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-85394