debian/python-jose vulnerabilities

Latest debian/python-jose CVEs

Newest publication first

1. CVE-2024-33664 python-jose denial of service via compressed JWE content

   Medium·CVSS 5.3

   python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

2. CVE-2024-33663 python-jose algorithm confusion with OpenSSH ECDSA keys

   Critical·CVSS 9.3

   python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.