CVE-2024-33663

The python-jose library (versions through 3.5.0 ) is vulnerable to algorithm confusion during HMAC initialization. The root cause is a failure to properly validate asymmetric keys, specifically accepting DER-encoded public keys that lack PEM armor or SSH prefixes. This allows an attacker possessi...

CVE-2024-33664

The python-jose library (through version 3.3.0 ) is vulnerable to a denial of service (DoS) via uncontrolled resource consumption (CWE-400). A remote authenticated attacker can exploit a flaw in the decode function by providing a crafted JSON Web Encryption (JWE) token with a high compression rat...

CVE-2016-7036

CVE-2016-7036 affects the Python package python-jose before version 1.3.2 . The vulnerability arises from not using a constant-time comparison when validating HMAC keys, allowing an attacker to induce an unspecified impact. Public sources in the connected set confirm the issue and point to a fix ...

CVE-2024-29370

The python-jose library (version 3.3.0) contains a Denial-of-Service (DoS) vulnerability within the jwe.decrypt function. An attacker can trigger this by providing a malicious JSON Web Encryption (JWE) token featuring an exceptionally high compression ratio. When the server attempts to process th...