Denial of Service Vulnerability in python-jwcrypto: High Compression Ratio JWE Token Exploit
Summary
CVE-2024-28102: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Affects python-jwcrypto across 2 version ranges.
< 0.8.0-1+deb11u1
< 90477a3b6e73da69740e00b8161f53fea19b831f
Fixed in 0.8.0-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-jwcrypto is a library that implements JSON Web Key (JWK), JSON Web Signature (JWS), and JSON Web Encryption (JWE) specifications using the python-cryptography library. It is widely used for secure token generation and management in web applications. However, prior to version 1.5.6, the library was susceptible to a denial of service attack due to its handling of JWE tokens with high compression ratios, which could lead to excessive memory and processing time consumption.
Vulnerability Detail
The vulnerability arises from the way python-jwcrypto processes JWE tokens. An attacker can craft a malicious JWE token that, when processed by the server, consumes an inordinate amount of memory and CPU resources. This can lead to a denial of service, making the application unresponsive. The issue was identified in versions prior to 1.5.6, and it was addressed by implementing a maximum token length limit in the library.
How To Fix
Minimum fixed version
0.8.0-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-jwcryptoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to reject JWE tokens that exceed a certain size or compression ratio. This can help mitigate the risk of denial of service attacks until the library can be updated.
Conclusion
The python-jwcrypto library has a critical vulnerability that can lead to denial of service attacks through the exploitation of JWE tokens with high compression ratios. It is essential to update to the latest versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python-jwcrypto →
FAQ
The vulnerability allows an attacker to exploit the processing of JWE tokens, leading to potential denial of service due to excessive resource consumption.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Versions prior to 1.5.6 for Debian 13, 1.1.0-1+deb12u1 for Debian 12, and 0.8.0-1+deb11u1 for Debian 11 are affected by this vulnerability.
Implement input validation to reject overly large JWE tokens as a temporary measure until you can upgrade the library.
Vulert is a service that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities, helping you maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for python-jwcrypto.
