CVE-2024-33663: python-jose Algorithm Confusion Guard Bypass via DER-Encoded Public Keys
Summary
CVE-2024-33663: python-jose algorithm confusion guard bypassed by DER-encoded public keys. Affects python-jose versions < 3.5.0. No fix is published. How to fix ↓
Also tracked for
- python-jose · Debian:12
The same CVE-2024-33663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-jose is a popular library in the Python ecosystem that provides support for JSON Web Tokens (JWT) and other JSON Object Signing and Encryption (JOSE) standards. It allows developers to create, sign, and verify tokens securely. However, the library has a vulnerability that affects its ability to validate asymmetric keys during HMAC initialization, which can lead to serious security issues if not addressed.
Vulnerability Detail
The vulnerability arises from python-jose versions up to 3.5.0 failing to properly validate asymmetric keys. Specifically, it accepts DER-encoded public keys that do not have PEM armor or SSH prefixes. This flaw allows attackers who possess the service's public key to forge HS256 tokens that can pass verification, especially when the algorithms are not explicitly restricted. This is an incomplete fix for a previously reported issue (CVE-2024-33663), making it critical for users to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the algorithms used for token verification explicitly in your application to mitigate the risk of token forgery. Ensure that only trusted algorithms are allowed for token verification.
Conclusion
The python-jose library has a critical vulnerability that allows for algorithm confusion and token forgery due to improper validation of asymmetric keys. It is essential for users to update to the latest version to mitigate this risk. Additionally, implementing algorithm restrictions can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-jose →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Versions of python-jose from 0.0.0 up to 3.5.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update the package immediately, ensure to restrict the algorithms used for token verification in your application as a temporary measure.
Yes, if exploited, this vulnerability can allow attackers to forge tokens, potentially leading to unauthorized access and data compromise.
Related vulnerabilities
Recent vulnerabilities recorded for python-jose.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
