Summary
[0.8-5]
- Address potential DoS with high compression ratio
Resolves: RHEL-28698
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python3-jwcrypto | 0:0.8-5.el9_4 |
Vulnerabilities 1
-
Medium 6.8
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, i…