Denial of Service Vulnerability in python-jwcrypto Package
Summary
DEBIAN-CVE-2024-28102: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Affects python-jwcrypto versions < 0.8.0-1+deb11u1. Fixed in 0.8.0-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-jwcrypto package is a Python library that implements JSON Web Key (JWK), JSON Web Signature (JWS), and JSON Web Encryption (JWE) specifications using the python-cryptography library. It is widely used for secure data transmission and authentication in web applications. However, prior to version 1.5.6, the package was vulnerable to a denial of service attack due to improper handling of JWE tokens, which could lead to excessive memory and processing time consumption.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to craft a malicious JWE token with a high compression ratio. When the server processes this token, it can lead to significant resource exhaustion, causing a denial of service. This issue is particularly concerning as it can be exploited without authentication, making it a critical risk for applications relying on this library for secure communications.
How To Fix
Minimum fixed version
0.8.0-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-jwcryptoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to reject JWE tokens that exceed a certain size or complexity, thus mitigating the risk of denial of service until the package can be updated.
Conclusion
The python-jwcrypto package has a critical vulnerability that can lead to denial of service attacks through malicious JWE tokens. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help protect applications until updates are applied.
See every vulnerability recorded for python-jwcrypto →
FAQ
The vulnerability allows attackers to exploit the handling of JWE tokens, leading to potential denial of service due to excessive resource consumption.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Versions prior to 1.5.6 for Debian 13 and 14, and prior to 1.1.0 for Debian 12, are affected by this vulnerability.
While the vulnerability primarily leads to denial of service, it does not directly compromise data integrity or confidentiality. However, it can disrupt service availability.
Implement input validation to limit the size and complexity of JWE tokens as a temporary measure to reduce the risk of denial of service.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-jwcrypto.
