Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/python-jose@3.0.1
Typepypi
Namespace
Namepython-jose
Version3.0.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.4.0
Latest_non_vulnerable_version3.4.0
Affected_by_vulnerabilities
0
url VCID-az98-gfrm-c3ev
vulnerability_id VCID-az98-gfrm-c3ev
summary python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33664.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33664.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-33664
reference_id
reference_type
scores
0
value 0.00194
scoring_system epss
scoring_elements 0.41335
published_at 2026-04-02T12:55:00Z
1
value 0.00194
scoring_system epss
scoring_elements 0.41339
published_at 2026-04-18T12:55:00Z
2
value 0.00194
scoring_system epss
scoring_elements 0.41368
published_at 2026-04-16T12:55:00Z
3
value 0.00194
scoring_system epss
scoring_elements 0.41325
published_at 2026-04-13T12:55:00Z
4
value 0.00194
scoring_system epss
scoring_elements 0.41338
published_at 2026-04-12T12:55:00Z
5
value 0.00194
scoring_system epss
scoring_elements 0.4137
published_at 2026-04-11T12:55:00Z
6
value 0.00194
scoring_system epss
scoring_elements 0.41349
published_at 2026-04-09T12:55:00Z
7
value 0.00194
scoring_system epss
scoring_elements 0.41342
published_at 2026-04-08T12:55:00Z
8
value 0.00194
scoring_system epss
scoring_elements 0.41291
published_at 2026-04-07T12:55:00Z
9
value 0.00194
scoring_system epss
scoring_elements 0.41363
published_at 2026-04-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-33664
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/mpdavis/python-jose
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose
4
reference_url https://github.com/mpdavis/python-jose/issues/344
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T13:47:15Z/
url https://github.com/mpdavis/python-jose/issues/344
5
reference_url https://github.com/mpdavis/python-jose/pull/345
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T13:47:15Z/
url https://github.com/mpdavis/python-jose/pull/345
6
reference_url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
7
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-233.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-233.yaml
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-33664
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-33664
9
reference_url https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T13:47:15Z/
url https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
reference_id 1070375
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
11
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2277300
reference_id 2277300
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2277300
12
reference_url https://github.com/advisories/GHSA-cjwg-qfpm-7377
reference_id GHSA-cjwg-qfpm-7377
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-cjwg-qfpm-7377
fixed_packages
0
url pkg:pypi/python-jose@3.4.0
purl pkg:pypi/python-jose@3.4.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0
aliases CVE-2024-33664, GHSA-cjwg-qfpm-7377, PYSEC-2024-233
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-az98-gfrm-c3ev
1
url VCID-vnjx-j746-z3fn
vulnerability_id VCID-vnjx-j746-z3fn
summary python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33663.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33663.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-33663
reference_id
reference_type
scores
0
value 0.00684
scoring_system epss
scoring_elements 0.7161
published_at 2026-04-02T12:55:00Z
1
value 0.00684
scoring_system epss
scoring_elements 0.71689
published_at 2026-04-18T12:55:00Z
2
value 0.00684
scoring_system epss
scoring_elements 0.71684
published_at 2026-04-16T12:55:00Z
3
value 0.00684
scoring_system epss
scoring_elements 0.71658
published_at 2026-04-12T12:55:00Z
4
value 0.00684
scoring_system epss
scoring_elements 0.71675
published_at 2026-04-11T12:55:00Z
5
value 0.00684
scoring_system epss
scoring_elements 0.71651
published_at 2026-04-09T12:55:00Z
6
value 0.00684
scoring_system epss
scoring_elements 0.7164
published_at 2026-04-13T12:55:00Z
7
value 0.00684
scoring_system epss
scoring_elements 0.716
published_at 2026-04-07T12:55:00Z
8
value 0.00684
scoring_system epss
scoring_elements 0.71628
published_at 2026-04-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-33663
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/mpdavis/python-jose
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose
4
reference_url https://github.com/mpdavis/python-jose/issues/346
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-17T13:37:11Z/
url https://github.com/mpdavis/python-jose/issues/346
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-33663
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-33663
7
reference_url https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-17T13:37:11Z/
url https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
8
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
reference_id 1070375
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2277297
reference_id 2277297
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2277297
10
reference_url https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
reference_id GHSA-6c5p-j8vq-pqhj
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
11
reference_url https://access.redhat.com/errata/RHSA-2024:6428
reference_id RHSA-2024:6428
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:6428
fixed_packages
0
url pkg:pypi/python-jose@3.4.0
purl pkg:pypi/python-jose@3.4.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0
aliases CVE-2024-33663, GHSA-6c5p-j8vq-pqhj, PYSEC-2024-232
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vnjx-j746-z3fn
2
url VCID-x2xb-crrp-hfaf
vulnerability_id VCID-x2xb-crrp-hfaf
summary 
Duplicate Advisory: python-jose denial of service via compressed JWE content
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references.

### Original Description

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29370.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29370.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-29370
reference_id
reference_type
scores
0
value 0.00156
scoring_system epss
scoring_elements 0.3635
published_at 2026-04-16T12:55:00Z
1
value 0.00156
scoring_system epss
scoring_elements 0.36308
published_at 2026-04-13T12:55:00Z
2
value 0.00156
scoring_system epss
scoring_elements 0.36329
published_at 2026-04-12T12:55:00Z
3
value 0.00156
scoring_system epss
scoring_elements 0.36365
published_at 2026-04-11T12:55:00Z
4
value 0.00156
scoring_system epss
scoring_elements 0.36359
published_at 2026-04-09T12:55:00Z
5
value 0.00156
scoring_system epss
scoring_elements 0.36338
published_at 2026-04-08T12:55:00Z
6
value 0.00156
scoring_system epss
scoring_elements 0.36454
published_at 2026-04-04T12:55:00Z
7
value 0.00156
scoring_system epss
scoring_elements 0.36422
published_at 2026-04-02T12:55:00Z
8
value 0.00156
scoring_system epss
scoring_elements 0.36289
published_at 2026-04-07T12:55:00Z
9
value 0.00201
scoring_system epss
scoring_elements 0.42236
published_at 2026-04-18T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-29370
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/mpdavis/python-jose/commit/483529ee93a3ab510ab579d4d4cc644dba926ade
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/commit/483529ee93a3ab510ab579d4d4cc644dba926ade
4
reference_url https://github.com/mpdavis/python-jose/issues/344
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/issues/344
5
reference_url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2423195
reference_id 2423195
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2423195
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-29370
reference_id CVE-2024-29370
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-29370
8
reference_url https://github.com/advisories/GHSA-h4pw-wxh7-4vjj
reference_id GHSA-h4pw-wxh7-4vjj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-h4pw-wxh7-4vjj
fixed_packages
0
url pkg:pypi/python-jose@3.4.0
purl pkg:pypi/python-jose@3.4.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0
aliases CVE-2024-29370, GHSA-h4pw-wxh7-4vjj
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-x2xb-crrp-hfaf
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.0.1