CVE-2024-28102

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28102", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-04T14:19:14.058Z", "datePublished": "2024-03-06T21:09:58.064Z", "dateUpdated": "2024-09-09T13:06:44.240Z"}, "containers": {"cna": {"title": "JWCrypto vulnerable to JWT bomb Attack in `deserialize` function", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97"}, {"name": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f", "tags": ["x_refsource_MISC"], "url": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f"}], "affected": [{"vendor": "latchset", "product": "jwcrypto", "versions": [{"version": "< 1.5.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T21:09:58.064Z"}, "descriptions": [{"lang": "en", "value": "JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length."}], "source": {"advisory": "GHSA-j857-7rvv-vj97", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"name": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97"}, {"name": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f"}, {"url": "https://www.vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00026.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-09T13:06:44.240Z"}}, {"affected": [{"vendor": "latchset", "product": "jwcrypto", "cpes": ["cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.5.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T19:56:39.446407Z", "id": "CVE-2024-28102", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T20:03:10.383Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97", "name": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f", "name": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://www.vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00026.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-09T13:06:44.240Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-28102", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T19:56:39.446407Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*"], "vendor": "latchset", "product": "jwcrypto", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.6", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T20:03:05.042Z"}}], "cna": {"title": "JWCrypto vulnerable to JWT bomb Attack in `deserialize` function", "source": {"advisory": "GHSA-j857-7rvv-vj97", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "latchset", "product": "jwcrypto", "versions": [{"status": "affected", "version": "< 1.5.6"}]}], "references": [{"url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97", "name": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f", "name": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T21:09:58.064Z"}}}, "cveMetadata": {"cveId": "CVE-2024-28102", "state": "PUBLISHED", "dateUpdated": "2024-09-09T13:06:44.240Z", "dateReserved": "2024-03-04T14:19:14.058Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-06T21:09:58.064Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "jwcrypto", "vendor": "latchset", "versions": [{"status": "affected", "version": "< 1.5.6"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "jwcrypto", "vendor": "latchset", "versions": [{"lessThan": "1.5.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*", "matchCriteriaId": "E81FD736-42B4-4716-9C91-587FAC88E6B4", "versionEndExcluding": "1.5.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length."}, {"lang": "es", "value": "JWCrypto implementa las especificaciones JWK, JWS y JWE utilizando criptograf\u00eda Python. Antes de la versi\u00f3n 1.5.6, un atacante pod\u00eda provocar un ataque de denegaci\u00f3n de servicio al pasar un token JWE malicioso con una alta tasa de compresi\u00f3n. Cuando el servidor procese este token, consumir\u00e1 mucha memoria y tiempo de procesamiento. La versi\u00f3n 1.5.6 corrige esta vulnerabilidad limitando la longitud m\u00e1xima del token."}], "id": "CVE-2024-28102", "lastModified": "2026-06-17T07:20:58.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-28102", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-02T19:56:39.446407Z", "version": "2.0.3"}}]}, "published": "2024-03-21T02:52:23.513", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00026.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Press/Media Coverage", "Technical Description"], "url": "https://www.vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:4522", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el8", "package": "automation-controller-0:4.5.8-1.el8ap", "product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 8", "release_date": "2024-07-12T00:00:00Z"}, {"advisory": "RHSA-2024:4522", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el9", "package": "automation-controller-0:4.5.8-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 9", "release_date": "2024-07-12T00:00:00Z"}, {"advisory": "RHSA-2024:3267", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "idm:client-8100020240417004735.143e9e98", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:3267", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "idm:DL1-8100020240416171943.823393f5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:2559", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "python-jwcrypto-0:0.8-5.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}], "bugzilla": {"description": "python-jwcrypto: malicious JWE token can cause denial of service", "id": "2268758", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268758"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.", "An uncontrolled resource consumption vulnerability was found in python-jwcrypto. If a malicious JWE token with a high compression ratio is passed to the server, the server will consume a lot of memory and processing time, leading to a denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-28102", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "python-jwcrypto", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2024-03-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-28102\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-28102\nhttps://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f\nhttps://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97"], "statement": "The CVE-2024-28102 vulnerability in JWCrypto represents a moderate severity issue due to its potential impact on system availability and resource consumption. While the vulnerability allows for a denial of service (DoS) attack, it requires an attacker to craft a malicious JWE Token with a high compression ratio. This specific condition limits the practical exploitability of the vulnerability to some extent, as it demands a more sophisticated attack approach than common vulnerabilities. Nonetheless, if exploited, the vulnerability can lead to significant memory exhaustion and increased server processing time, impacting the overall performance and availability of the affected system.", "threat_severity": "Moderate"}

{}