Fluid Attacks Database

Description

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	python-jwcrypto	>=0 <1.5.6-1	1.5.6-1
debian 14	python-jwcrypto	>=0 <1.5.6-1	1.5.6-1
debian 12	python-jwcrypto	=1.1.0-1 \|\| >=0 <1.1.0-1+deb12u1	1.1.0-1+deb12u1
pypi	jwcrypto	>=0 <1.5.6	1.5.6
rpm rhel7	python-jwcrypto	-	-
rpm rhel9	python-jwcrypto	<0:0.8-5.el9_4	0:0.8-5.el9_4

Aliases

1. CVE-2024-281022. NVD-2024-281023. OSV-DEBIAN-2024-281024. OSV-2024-281025. GHSA-j857-7rvv-vj976. GCVE-2024-281027. SECURITY-TRACKER-CVE-2024-281028. lists.debian.org

References

1. https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj972. https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f3. https://www.vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.