Denial of Service Vulnerability in python-jose: JWT Bomb Risk
Summary
CVE-2024-33664: python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is simila... Affects python-jose versions < e5fcca27712c0ebdeb55d3c3cdad1c6e0f708ac3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-jose is a Python library that provides tools for working with JSON Web Tokens (JWT), including encoding and decoding JWTs and JSON Web Encryption (JWE). It is widely used in applications that require secure token-based authentication. However, the library is susceptible to a denial of service (DoS) attack when handling specially crafted JWE tokens, particularly those with a high compression ratio.
Vulnerability Detail
The vulnerability, identified as CVE-2024-33664, allows attackers to exploit the python-jose library by sending a crafted JWE token that consumes excessive resources during the decoding process. This is often referred to as a 'JWT bomb.' The attack can lead to service unavailability, as the application may become unresponsive due to resource exhaustion. This vulnerability is similar to CVE-2024-21319 and affects versions of python-jose up to 3.3.0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to reject JWE tokens that exhibit unusually high compression ratios. This can help prevent the processing of potentially malicious tokens until an update can be applied.
Conclusion
The CVE-2024-33664 vulnerability in python-jose poses a significant risk of denial of service through the exploitation of crafted JWE tokens. It is crucial for developers using this library to update to a secure version and consider implementing additional validation measures to protect their applications.
See every vulnerability recorded for python-jose →
FAQ
CVE-2024-33664 is a vulnerability in the python-jose library that allows attackers to cause a denial of service by sending specially crafted JWE tokens.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected by CVE-2024-33664.
The primary impact is denial of service, where the application may become unresponsive due to resource exhaustion caused by processing malicious JWE tokens.
Yes, you can implement input validation to reject JWE tokens with high compression ratios as a temporary workaround.
More information can be found in the official CVE database and on the GitHub repository for python-jose.
Related vulnerabilities
Recent vulnerabilities recorded for python-jose.
