JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-jwcrypto | May 8, 2024 | Mar 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-jwcrypto | Feb 26, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade python-jwcrypto | Jul 30, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade softhsm-develUpgrade ipa-client-sambaUpgrade ipa-serverUpgrade python3-ipaserverUpgrade python3-ipalibUpgrade python3-jwcryptoUpgrade ipa-healthcheckUpgrade slapi-nisUpgrade ipa-commonUpgrade ipa-selinuxUpgrade custodiaUpgrade ipa-server-trust-adUpgrade python3-yubicoUpgrade python3-ipatestsUpgrade ipa-clientUpgrade python3-kdcproxyUpgrade bind-dyndb-ldapUpgrade ipa-client-epnUpgrade python3-pyusbUpgrade ipa-server-dnsUpgrade python3-custodiaUpgrade ipa-client-commonUpgrade ipa-healthcheck-coreUpgrade softhsmUpgrade ipa-python-compatUpgrade opendnssecUpgrade python3-ipaclientUpgrade ipa-server-commonUpgrade python3-qrcode-coreUpgrade python3-qrcode | May 7, 2024 | Mar 8, 2024 |
| Redhat_linux | — | Upgrade python3-jwcryptoNo solution exists | May 1, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade ipa-client-sambaUpgrade ipa-client-epnUpgrade bind-dyndb-ldapUpgrade bind-dyndb-ldap-debuginfoUpgrade slapi-nis-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-clientUpgrade softhsmUpgrade ipa-debuginfoUpgrade softhsm-develUpgrade ipa-server-debuginfoUpgrade softhsm-debugsourceUpgrade opendnssec-debuginfoUpgrade ipa-client-debuginfoUpgrade ipa-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade opendnssec-debugsourceUpgrade opendnssecUpgrade ipa-serverUpgrade slapi-nisUpgrade ipa-server-trust-ad | May 13, 2024 | Mar 21, 2024 |
| Suse | — | Upgrade python313-jwcrypto | Dec 5, 2025 | Dec 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub