PYSEC-2025-185

En bref

Publiée
Mise à jour
CVE
CVE-2024-29370
Alias
GHSA-h4pw-wxh7-4vjj
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Paquets affectés

PaquetVersions
PyPI · python-joseintroduced 0, last affected 3.3.0

Références

Sources

SourceLicence
OSV.devCC-BY 4.0 — PyPA Advisory Database