Vulnerabilities for python-jose

First version without a known vulnerability: 3.4.0

Details

• PYSEC-2025-1852025-12-17

  In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

• GHSA-6c5p-j8vq-pqhj2024-04-26

  python-jose algorithm confusion with OpenSSH ECDSA keys

  Fixed in: 3.4.0

• GHSA-cjwg-qfpm-73772024-04-26

  python-jose denial of service via compressed JWE content

  Fixed in: 3.4.0

• GHSA-w799-prg3-cx772022-05-17

  python-jose failure to use a constant time comparison for HMAC keys

  Fixed in: 1.3.2