Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:pypi/python-jose@3.1.0

Type pypi

Namespace

Name python-jose

Version 3.1.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 3.4.0

Latest_non_vulnerable_version 3.4.0

Affected_by_vulnerabilities

url VCID-nph9-2swf-47cn

vulnerability_id VCID-nph9-2swf-47cn

summary python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

references

reference_url	https://github.com/mpdavis/python-jose/issues/346
reference_id
reference_type
scores
url	https://github.com/mpdavis/python-jose/issues/346

reference_url	https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
reference_id
reference_type
scores
url	https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663

fixed_packages

url	pkg:pypi/python-jose@3.4.0
purl	pkg:pypi/python-jose@3.4.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0

aliases CVE-2024-33663, PYSEC-2024-232

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nph9-2swf-47cn

url VCID-qr7r-81eb-sud4

vulnerability_id VCID-qr7r-81eb-sud4

summary python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

references

reference_url	https://github.com/mpdavis/python-jose/issues/344
reference_id
reference_type
scores
url	https://github.com/mpdavis/python-jose/issues/344

reference_url	https://github.com/mpdavis/python-jose/pull/345
reference_id
reference_type
scores
url	https://github.com/mpdavis/python-jose/pull/345

reference_url	https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
reference_id
reference_type
scores
url	https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664

fixed_packages

url	pkg:pypi/python-jose@3.4.0
purl	pkg:pypi/python-jose@3.4.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0

aliases CVE-2024-33664, PYSEC-2024-233

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qr7r-81eb-sud4

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.1.0

Package Instance