CVE-2024-33663: python-jose Algorithm Confusion Vulnerability
Summary
CVE-2024-33663: python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217. Affects python-jose versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- python-jose · Debian:12
The same CVE-2024-33663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-jose is a popular library in the Python ecosystem used for creating and verifying JSON Web Tokens (JWTs). It supports various algorithms for signing and encryption, making it versatile for developers implementing authentication and authorization in their applications. However, the library has been found to have an algorithm confusion vulnerability that affects its handling of OpenSSH ECDSA keys and other key formats, potentially leading to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2024-33663 in python-jose through version 3.3.0 arises from an algorithm confusion issue. This flaw allows attackers to exploit the library's handling of different key formats, particularly OpenSSH ECDSA keys. The confusion can lead to improper validation of tokens, which may allow unauthorized access or manipulation of sensitive data. This vulnerability is similar to CVE-2022-29217, indicating a recurring issue in the library's design regarding key management and algorithm selection.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
pip install --upgrade "python-jose==3.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
pip install --upgrade "python-jose==3.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using OpenSSH ECDSA keys with the python-jose library until you can upgrade to the patched version. Additionally, consider implementing additional validation checks in your application to ensure that only expected key formats are processed.
Conclusion
The CVE-2024-33663 vulnerability in the python-jose library poses significant risks due to algorithm confusion with certain key formats. It is crucial for developers using this library to update to version 3.4.0 or later to mitigate these risks. Additionally, understanding the nature of this vulnerability can help in implementing better security practices.
See every vulnerability recorded for python-jose →
FAQ
CVE-2024-33663 is a vulnerability in the python-jose library that involves algorithm confusion with OpenSSH ECDSA keys, potentially allowing unauthorized access.
Versions of python-jose up to and including 3.3.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade immediately, avoid using OpenSSH ECDSA keys with the library and implement additional validation checks.
More information can be found in the official advisory on the GitHub repository or by searching for CVE-2024-33663.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-jose.
