CVE-2024-33663

The python-jose library (versions through 3.3.0) is vulnerable to an algorithm confusion flaw when the algorithm field is left unspecified during jwt.decode calls. This allows a remote attacker to bypass security restrictions by forcing HS256 verification using OpenSSH ECDSA public keys or other ...

CVE-2024-29370

The python-jose library (version 3.3.0) contains a Denial-of-Service (DoS) vulnerability within the jwe.decrypt function. An attacker can trigger this by providing a malicious JSON Web Encryption (JWE) token featuring an exceptionally high compression ratio. When the server attempts to process th...