Bug 2268758 (CVE-2024-28102)

Summary:	CVE-2024-28102 python-jwcrypto: malicious JWE token can cause denial of service
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, davidn, epacific, jcammara, jhardy, jneedle, jobarker, kshier, mabashia, omaciel, osapryki, rbobbitt, simaishi, smcdonal, stcannon, teagle, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-jwcrypto 1.5.6	Doc Type:	---
Doc Text:	An uncontrolled resource consumption vulnerability was found in python-jwcrypto. If a malicious JWE token with a high compression ratio is passed to the server, the server will consume a lot of memory and processing time, leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2268759
Bug Blocks:	2268760

Description ybuenos 2024-03-10 09:04:51 UTC

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Comment 1 ybuenos 2024-03-10 09:05:07 UTC

Created python-jwcrypto tracking bugs for this issue:

Affects: fedora-all [bug 2268759]

Comment 4 errata-xmlrpc 2024-04-30 14:39:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2559 https://access.redhat.com/errata/RHSA-2024:2559