REDHAT-BUG-2490168: Medium severity pypi/joserfc vulnerability
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.maxpayloadlength. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
joserfcto a version that resolves this vulnerability.Fixed in 1.6.7
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2490168?
The severity of REDHAT-BUG-2490168 is medium with a score of 4.
How do I fix REDHAT-BUG-2490168?
To fix REDHAT-BUG-2490168, upgrade the joserfc library to a version later than 1.6.5.
What are the risks associated with REDHAT-BUG-2490168?
The risks associated with REDHAT-BUG-2490168 include potential resource exhaustion due to oversized JWS payloads.
Which versions of joserfc are affected by REDHAT-BUG-2490168?
Versions 1.3.4 through 1.6.5 of joserfc are affected by REDHAT-BUG-2490168.
What is the main issue caused by REDHAT-BUG-2490168?
The main issue caused by REDHAT-BUG-2490168 is that oversized JWS payloads are accepted, leading to resource exhaustion.