CVE-2024-29370
📋 TL;DR
This vulnerability in python-jose 3.3.0 allows attackers to cause Denial-of-Service (DoS) by sending malicious JWE tokens with high compression ratios, leading to excessive memory consumption and CPU usage during decompression. Any system using python-jose 3.3.0 for JWE token processing is affected, particularly web applications and APIs that accept JWE tokens.
💻 Affected Systems
- python-jose
📦 What is this software?
Python Jose by Python Jose Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to memory exhaustion and CPU saturation, potentially requiring server restarts and causing extended downtime.
Likely Case
Temporary service degradation or intermittent outages affecting user experience and application performance.
If Mitigated
Minimal impact with proper rate limiting, input validation, and monitoring in place to detect and block malicious requests.
🎯 Exploit Status
Exploitation requires sending a crafted JWE token to a vulnerable endpoint. The GitHub issue includes proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.0
Vendor Advisory: https://github.com/mpdavis/python-jose/issues/344
Restart Required: No
Instructions:
1. Update python-jose: pip install python-jose==3.4.0
2. Verify the update: pip show python-jose
3. Test JWE functionality to ensure compatibility.
🔧 Temporary Workarounds
Input validation and size limits
allImplement request size limits and validate JWE tokens before processing
Rate limiting
allImplement rate limiting on endpoints accepting JWE tokens to prevent mass exploitation
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block requests with suspicious JWE tokens
- Monitor memory and CPU usage for abnormal spikes and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check python-jose version: pip show python-jose | grep VersionCheck Version:
pip show python-jose | grep VersionVerify Fix Applied:
Verify version is 3.4.0 or higher: pip show python-jose | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusually large request sizes
- Multiple failed JWE decryption attempts
- Memory allocation errors in application logs
Network Indicators:
- Large HTTP POST requests to JWE endpoints
- Spike in request rate to authentication/decryption endpoints
SIEM Query:
source=application_logs "jwe.decrypt" AND ("memory" OR "timeout" OR "error")