CVE-2024-29370

{
  "id": "CVE-2024-29370",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-17T16:16:04.457",
  "lastModified": "2026-10-27T18:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression."
    },
    {
      "lang": "es",
      "value": "En python-jose 3.3.0 (específicamente jwe.decrypt), una vulnerabilidad permite a un atacante causar una condición de Denegación de Servicio (DoS) al crear un token de Cifrado Web JSON (JWE) malicioso con una relación de compresión excepcionalmente alta. Cuando este token es procesado por el servidor, resulta en una asignación de memoria y un tiempo de procesamiento significativos durante la descompresión."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-17T16:07:11.042805Z",
          "id": "CVE-2024-29370",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-409"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:python-jose_project:python-jose:3.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89A29F0D-0CC6-4177-8E90-B192A39EB233"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mpdavis/python-jose/issues/344",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch"
      ]
    }
  ]
}