CVE-2024-33664: Medium severity pip/python-jose vulnerability
Published Apr 25, 2024
·Updated
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
Affected Software
2 affected componentsFixes available
pip/python-jose<3.4.0
3.4.0
Python-jose Project Python-jose<=3.3.0
Remediation
Patch Available
Event History
Apr 25, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Apr 26, 2024
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 AM
RemedyAffected Software
Advisory Published
via GitHub·12:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-33664?
CVE-2024-33664 is classified as a denial of service vulnerability.
2
How do I fix CVE-2024-33664?
To fix CVE-2024-33664, upgrade python-jose to version 3.4.0 or later.
3
What version of python-jose is affected by CVE-2024-33664?
Versions of python-jose up to and including 3.3.0 are affected by CVE-2024-33664.
4
What attack vector is associated with CVE-2024-33664?
CVE-2024-33664 can be exploited through a crafted JWE token that causes resource exhaustion during decoding.
5
Is CVE-2024-33664 related to other vulnerabilities?
Yes, CVE-2024-33664 is similar to CVE-2024-21319, which also involves denial of service through JWT.