Vulnerability PYSEC-2024-232
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 years ago
April 26, 2024 at 12:15 AM UTC
No summary available
0.1.0 - 3.3.0
0.1.0 - 3.3.0
Details
python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
4 days ago
python-jose algorithm confusion guard bypassed by DER-encoded public keys
0.1.0 - 3.5.0 PYSEC-2026-4298
0.1.0 - 3.5.0 PYSEC-2026-4298
Critical
1 month ago
python-jose algorithm confusion guard bypassed by DER-encoded public keys
0.1.0 - 3.5.0 GHSA-3qf3-8w2g-rqmx
0.1.0 - 3.5.0 GHSA-3qf3-8w2g-rqmx
Medium Risk
10 months ago
No summary available
0.1.0 - 3.3.0 PYSEC-2025-185
0.1.0 - 3.3.0 PYSEC-2025-185
High Risk
2 years ago
python-jose algorithm confusion with OpenSSH ECDSA keys
0.1.0 - 3.3.0 GHSA-6c5p-j8vq-pqhj
0.1.0 - 3.3.0 GHSA-6c5p-j8vq-pqhj
Medium Risk
2 years ago
python-jose denial of service via compressed JWE content
0.1.0 - 3.3.0 GHSA-cjwg-qfpm-7377
0.1.0 - 3.3.0 GHSA-cjwg-qfpm-7377
Impacted packages
Timeline
Published
2 years ago
April 26, 2024 at 12:15 AM UTC
Fixed (3.4.0)
1 year ago
February 18, 2025 at 05:26 PM UTC
Last Modified
4 days ago
October 15, 2026 at 02:56 PM UTC