Threats Tagged 'cve-2026-84185'

These are all security issues fixed in the python313-jwcrypto-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

CVE-2026-84185 is a medium severity vulnerability in the jwcrypto library used by Red Hat Ansible Automation Platform 2. The flaw involves improper verification of cryptographic signatures in JSON Web Signatures (JWS) when multiple keys are used. Due to a coding error, the library may accept a signature from any valid key in the set rather than verifying the specific key ID (kid). This can allow an attacker with a valid key to bypass authorization checks that rely on the key ID to identify tenants or users.

A vulnerability in the python-jwcrypto library allows a remote attacker to cause a denial of service by sending a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This issue affects multiple specific versions of the library and impacts the availability of cryptographic operations.

A denial of service vulnerability (CVE-2024-28102) exists in the python-jwcrypto package used in Red Hat Enterprise Linux 9 and related distributions. The issue occurs when processing malicious JSON Web Encryption (JWE) tokens, causing the application to become unresponsive. Red Hat has issued security updates to address this vulnerability. The fix is available and should be applied to affected systems to prevent denial of service conditions.