CVE-2024-33663: High severity Python-jose Project Python-jose vulnerability
Published Apr 25, 2024
·Updated
python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
Affected Software
2 affected componentsFixes available
pip/python-jose<3.4.0
3.4.0
Python-jose Project Python-jose<=3.3.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/python-joseto a version that resolves this vulnerability.Fixed in 3.4.0
Event History
Apr 25, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Apr 26, 2024
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·12:30 AM
Data Sourced
via Red Hat·05:56 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-33663?
CVE-2024-33663 is considered to have a moderate severity due to its algorithm confusion vulnerabilities.
2
How do I fix CVE-2024-33663?
To fix CVE-2024-33663, upgrade python-jose to version 3.4.0 or later.
3
What types of keys are affected by CVE-2024-33663?
CVE-2024-33663 affects OpenSSH ECDSA keys and possibly other key formats.
4
Is CVE-2024-33663 similar to any other vulnerabilities?
Yes, CVE-2024-33663 is similar to CVE-2022-29217, which also involves algorithm confusion.
5
What is python-jose and how is it related to CVE-2024-33663?
Python-jose is a library for handling JSON Web Tokens which is vulnerable under certain conditions as specified in CVE-2024-33663.