python-jose security vulnerabilities

python-jose is a JOSE implementation in Python by the individual developer Michael Davis. A security vulnerability exists in python-jose 3.3.0 and earlier versions that originated from allowing an attacker to cause a denial of service via a specially crafted high-compression rate JSON Web...

python-jose security vulnerabilities

python-jose is a JOSE implementation in Python by the individual developer Michael Davis. A security vulnerability exists in python-jose 3.3.0 and earlier versions, which stems from confusion between OpenSSH ECDSA keys and other key formats...

CVE-2024-33664

python-jose through 3.3.0 allows attackers to cause a denial of service resource consumption during a decode via a crafted JSON Web Encryption JWE token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319...

CVE-2024-33663

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217...

CVE-2024-33664: Uncontrolled Resource Consumption

python-jose through 3.3.0 allows attackers to cause a denial of service resource consumption during a decode via a crafted JSON Web Encryption JWE token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319...

CVE-2024-33663: Use of a Broken or Risky Cryptographic Algorithm

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217...

aef-gw (>=0.1.1, <=0.1.15), agentmetrics-server (>=0.1.0, <=0.2.0) +173 more potentially affected by CVE-2024-33664 via python-jose (>=0.5.5, <=3.3.0)

python-jose PYPI version =0.5.5, =0.1.1, =0.1.0, =0.1.2, =0.1.0, =0.8.0, =0.9.0, =1.23.0.dev0, =0.1.2, =0.1.18, =1.1.3, =1.5.0, =0.1.7, =0.31.6, =0.33.1 and more Source cves: CVE-2024-33664 Source advisory: MEND:CVE-2024-33664...

aef-gw (>=0.1.1, <=0.1.15), agentmetrics-server (>=0.1.0, <=0.2.0) +173 more potentially affected by CVE-2024-33663 via python-jose (>=0.5.5, <=3.3.0)

python-jose PYPI version =0.5.5, =0.1.1, =0.1.0, =0.1.2, =0.1.0, =0.8.0, =0.9.0, =1.23.0.dev0, =0.1.2, =0.1.18, =1.1.3, =1.5.0, =0.1.7, =0.31.6, =0.33.1 and more Source cves: CVE-2024-33663 Source advisory: MEND:CVE-2024-33663...

CVE-2024-33663

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217...

CVE-2024-33664

python-jose through 3.3.0 allows attackers to cause a denial of service resource consumption during a decode via a crafted JSON Web Encryption JWE token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319...

PT-2025-51835

Name of the Vulnerable Software and Affected Versions python-jose version 3.3.0 Description A flaw exists in the jwe.decrypt function of python-jose that can lead to a Denial-of-Service DoS condition. An attacker can exploit this by providing a specially crafted JSON Web Encryption JWE token with...

PT-2024-41643

Уязвимость библиотеки python-jose связана с некорректной обработкой сильно сжатых входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

datawire-cloudtools (0.2.6) potentially affected by CVE-2016-7036 via python-jose (0.5.5)

python-jose PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - datawire-cloudtools 0.2.6 Source cves: CVE-2016-7036 Source advisory: OSV:GHSA-W799-PRG3-CX77...

python-jose failure to use a constant time comparison for HMAC keys

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys...

GHSA-W799-PRG3-CX77 python-jose failure to use a constant time comparison for HMAC keys

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys...

Unspecified vulnerability in python-jose

python-jose is an implementation of object signing and encryption. A security vulnerability exists in python-jose 1.3.1 and earlier versions; detailed vulnerability information is not currently available...

Timing Attack Via Authentication

python-jose is vulnerable to timing attacks. The vulnerability is possible because it has a flaw in verification function which allows a constant time comparison for HMAC keys...

CVE-2016-7036

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys...

CVE-2016-7036

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys...

datawire-cloudtools (0.2.6) potentially affected by CVE-2016-7036 via python-jose (0.5.5)

python-jose PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - datawire-cloudtools 0.2.6 Source cves: CVE-2016-7036 Source advisory: OSV:PYSEC-2017-28...