Bug 2268758 (CVE-2024-28102) - CVE-2024-28102 python-jwcrypto: malicious JWE token can cause denial of service
Summary: CVE-2024-28102 python-jwcrypto: malicious JWE token can cause denial of service
Keywords:
Status: NEW
Alias: CVE-2024-28102
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2268759
Blocks: 2268760
TreeView+ depends on / blocked
 
Reported: 2024-03-10 09:04 UTC by ybuenos
Modified: 2024-07-12 01:40 UTC (History)
18 users (show)

Fixed In Version: python-jwcrypto 1.5.6
Doc Type: ---
Doc Text:
An uncontrolled resource consumption vulnerability was found in python-jwcrypto. If a malicious JWE token with a high compression ratio is passed to the server, the server will consume a lot of memory and processing time, leading to a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:2559 0 None None None 2024-04-30 14:39:14 UTC
Red Hat Product Errata RHSA-2024:3267 0 None None None 2024-05-22 11:40:51 UTC
Red Hat Product Errata RHSA-2024:4522 0 None None None 2024-07-12 01:40:48 UTC

Description ybuenos 2024-03-10 09:04:51 UTC 
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
Comment 1 ybuenos 2024-03-10 09:05:07 UTC 
Created python-jwcrypto tracking bugs for this issue:

Affects: fedora-all [bug 2268759]
Comment 4 errata-xmlrpc 2024-04-30 14:39:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2559 https://access.redhat.com/errata/RHSA-2024:2559
Comment 5 errata-xmlrpc 2024-05-22 11:40:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3267 https://access.redhat.com/errata/RHSA-2024:3267
Comment 6 errata-xmlrpc 2024-07-12 01:40:46 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:4522 https://access.redhat.com/errata/RHSA-2024:4522
Note You need to log in before you can comment on or make changes to this bug.