Skip to content
OpenAdvisories

Package · PyPI

python-jose

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.3
    CVE-2024-29370

    In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) …

    python-jose python-jose python-jose Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2024-33664

    python-jose denial of service via compressed JWE content

    python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

    python-jose python-jose python-jose Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2024-33663

    python-jose algorithm confusion guard bypassed by DER-encoded public keys

    python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

    python-jose python-jose python-jose Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2016-7036

    python-jose failure to use a constant time comparison for HMAC keys

    python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.

    python-jose PyPI