CVE-2024-33663

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

CVE-2024-33664

The python-jose library (through version 3.3.0 ) is vulnerable to a denial of service (DoS) via uncontrolled resource consumption (CWE-400). A remote authenticated attacker can exploit a flaw in the decode function by providing a crafted JSON Web Encryption (JWE) token with a high compression rat...

CVE-2016-7036

CVE-2016-7036 affects the Python package python-jose before version 1.3.2 . The vulnerability arises from not using a constant-time comparison when validating HMAC keys, allowing an attacker to induce an unspecified impact. Public sources in the connected set confirm the issue and point to a fix ...

CVE-2024-29370

The python-jose library (version 3.3.0) contains a Denial-of-Service (DoS) vulnerability within the jwe.decrypt function. An attacker can trigger this by providing a malicious JSON Web Encryption (JWE) token featuring an exceptionally high compression ratio. When the server attempts to process th...