Threat database

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

CVE-2024-29370 is a medium severity vulnerability in python-jose 3.3.0's JWE decryption function that allows an attacker to cause a Denial-of-Service (DoS) by sending a malicious JSON Web Encryption token with an extremely high compression ratio. This crafted token triggers excessive memory allocation and processing time during decompression, potentially exhausting server resources. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. While no known exploits are currently reported in the wild, affected systems processing untrusted JWE tokens are at risk. The CVSS score is 5.3, reflecting a moderate impact on availability without affecting confidentiality or integrity. European organizations using python-jose for JWE token handling in web services or APIs should prioritize mitigation to prevent service disruption. No official patches are available yet, so defensive measures are critical.

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.