JWCrypto Fixes Denial of Service Vulnerability in python-cryptography
CVE-2024-28102

6.8MEDIUM

Key Information:

Vendor

Latchset

Status
Jwcrypto
Vendor
CVE Published:
21 March 2024

What is CVE-2024-28102?

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Affected Version(s)

jwcrypto < 1.5.6

References

https://github.com/latchset/jwcrypto/security/advisories/...
x_refsource_CONFIRM
https://github.com/latchset/jwcrypto/commit/90477a3b6e73d...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.