Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/python-jose@0.1.7
Typepypi
Namespace
Namepython-jose
Version0.1.7
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.4.0
Latest_non_vulnerable_version3.4.0
Affected_by_vulnerabilities
0
url VCID-hfgd-9e3j-qkhr
vulnerability_id VCID-hfgd-9e3j-qkhr
summary In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29370.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29370.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-29370
reference_id
reference_type
scores
0
value 0.00158
scoring_system epss
scoring_elements 0.36479
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-29370
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/mpdavis/python-jose/commit/483529ee93a3ab510ab579d4d4cc644dba926ade
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/commit/483529ee93a3ab510ab579d4d4cc644dba926ade
4
reference_url https://github.com/mpdavis/python-jose/issues/344
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/issues/344
5
reference_url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2423195
reference_id 2423195
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2423195
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-29370
reference_id CVE-2024-29370
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-29370
8
reference_url https://github.com/advisories/GHSA-h4pw-wxh7-4vjj
reference_id GHSA-h4pw-wxh7-4vjj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-h4pw-wxh7-4vjj
fixed_packages
0
url pkg:pypi/python-jose@3.4.0
purl pkg:pypi/python-jose@3.4.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0
aliases CVE-2024-29370, GHSA-h4pw-wxh7-4vjj, PYSEC-2025-185
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hfgd-9e3j-qkhr
1
url VCID-nph9-2swf-47cn
vulnerability_id VCID-nph9-2swf-47cn
summary python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33663.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33663.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-33663
reference_id
reference_type
scores
0
value 0.00925
scoring_system epss
scoring_elements 0.76435
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-33663
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/mpdavis/python-jose
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose
4
reference_url https://github.com/mpdavis/python-jose/issues/346
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-17T13:37:11Z/
url https://github.com/mpdavis/python-jose/issues/346
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml
6
reference_url https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-17T13:37:11Z/
url https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
7
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
reference_id 1070375
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2277297
reference_id 2277297
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2277297
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-33663
reference_id CVE-2024-33663
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 9.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-33663
10
reference_url https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
reference_id GHSA-6c5p-j8vq-pqhj
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
11
reference_url https://access.redhat.com/errata/RHSA-2024:6428
reference_id RHSA-2024:6428
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:6428
fixed_packages
0
url pkg:pypi/python-jose@3.4.0
purl pkg:pypi/python-jose@3.4.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0
aliases CVE-2024-33663, GHSA-6c5p-j8vq-pqhj, PYSEC-2024-232
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nph9-2swf-47cn
2
url VCID-qr7r-81eb-sud4
vulnerability_id VCID-qr7r-81eb-sud4
summary python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33664.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-33664.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-33664
reference_id
reference_type
scores
0
value 0.00254
scoring_system epss
scoring_elements 0.48932
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-33664
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/mpdavis/python-jose
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose
4
reference_url https://github.com/mpdavis/python-jose/issues/344
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T13:47:15Z/
url https://github.com/mpdavis/python-jose/issues/344
5
reference_url https://github.com/mpdavis/python-jose/pull/345
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T13:47:15Z/
url https://github.com/mpdavis/python-jose/pull/345
6
reference_url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/releases/tag/3.4.0
7
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-233.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-233.yaml
8
reference_url https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T13:47:15Z/
url https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
9
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
reference_id 1070375
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1070375
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2277300
reference_id 2277300
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2277300
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-33664
reference_id CVE-2024-33664
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-33664
12
reference_url https://github.com/advisories/GHSA-cjwg-qfpm-7377
reference_id GHSA-cjwg-qfpm-7377
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-cjwg-qfpm-7377
fixed_packages
0
url pkg:pypi/python-jose@3.4.0
purl pkg:pypi/python-jose@3.4.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@3.4.0
aliases CVE-2024-33664, GHSA-cjwg-qfpm-7377, PYSEC-2024-233
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qr7r-81eb-sud4
3
url VCID-wzf6-nvmk-tud8
vulnerability_id VCID-wzf6-nvmk-tud8
summary python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-7036
reference_id
reference_type
scores
0
value 0.00389
scoring_system epss
scoring_elements 0.6034
published_at 2026-06-05T12:55:00Z
1
value 0.00389
scoring_system epss
scoring_elements 0.60293
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-7036
1
reference_url https://github.com/mpdavis/python-jose
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose
2
reference_url https://github.com/mpdavis/python-jose/commit/73007d6887a7517ac07c6e755e494baee49ef513
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/commit/73007d6887a7517ac07c6e755e494baee49ef513
3
reference_url https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93
4
reference_url https://github.com/mpdavis/python-jose/releases/tag/1.3.2
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mpdavis/python-jose/releases/tag/1.3.2
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2017-28.yaml
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2017-28.yaml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-7036
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-7036
7
reference_url https://web.archive.org/web/20210123221523/http://www.securityfocus.com/bid/95845
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210123221523/http://www.securityfocus.com/bid/95845
8
reference_url http://www.securityfocus.com/bid/95845
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/95845
9
reference_url https://github.com/advisories/GHSA-w799-prg3-cx77
reference_id GHSA-w799-prg3-cx77
reference_type
scores
url https://github.com/advisories/GHSA-w799-prg3-cx77
fixed_packages
0
url pkg:pypi/python-jose@1.3.2
purl pkg:pypi/python-jose@1.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-hfgd-9e3j-qkhr
1
vulnerability VCID-nph9-2swf-47cn
2
vulnerability VCID-qr7r-81eb-sud4
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@1.3.2
aliases CVE-2016-7036, GHSA-w799-prg3-cx77, PYSEC-2017-28
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wzf6-nvmk-tud8
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/python-jose@0.1.7