CVE-2024-28102

2024-03-2102:52:23

CWE-770

[email protected]

web.nvd.nist.gov

jwcrypto

python-cryptography

jwk

jws

jwe

denial of service

memory consumption

high compression ratio

vulnerability fix

version 1.5.6

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

9.0%

JSON

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.