CVE-2024-29370: Medium severity pypi/python-jose vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references.
Original Description
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29370?
CVE-2024-29370 is classified as a Denial-of-Service (DoS) vulnerability due to the potential impact on server performance.
How do I fix CVE-2024-29370?
To mitigate CVE-2024-29370, update to a patched version of python-jose where the vulnerability has been addressed.
What software versions are affected by CVE-2024-29370?
CVE-2024-29370 affects python-jose version 3.3.0 and possibly earlier versions that handle JWE tokens.
How does CVE-2024-29370 impact server performance?
CVE-2024-29370 allows an attacker to create a JWE token with a high compression ratio, leading to excessive resource consumption and potential server downtime.
Who is at risk from CVE-2024-29370?
Developers and organizations using python-jose for JSON Web Encryption are at risk from CVE-2024-29370 if they have not upgraded to a safe version.