{
  "threat_severity" : "Moderate",
  "public_date" : "2024-03-08T00:00:00Z",
  "bugzilla" : {
    "description" : "python-jwcrypto: malicious JWE token can cause denial of service",
    "id" : "2268758",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2268758"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-400",
  "details" : [ "JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.", "An uncontrolled resource consumption vulnerability was found in python-jwcrypto. If a malicious JWE token with a high compression ratio is passed to the server, the server will consume a lot of memory and processing time, leading to a denial of service." ],
  "statement" : "The CVE-2024-28102 vulnerability in JWCrypto represents a moderate severity issue due to its potential impact on system availability and resource consumption. While the vulnerability allows for a denial of service (DoS) attack, it requires an attacker to craft a malicious JWE Token with a high compression ratio. This specific condition limits the practical exploitability of the vulnerability to some extent, as it demands a more sophisticated attack approach than common vulnerabilities. Nonetheless, if exploited, the vulnerability can lead to significant memory exhaustion and increased server processing time, impacting the overall performance and availability of the affected system.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
    "release_date" : "2024-07-12T00:00:00Z",
    "advisory" : "RHSA-2024:4522",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
    "package" : "automation-controller-0:4.5.8-1.el8ap"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
    "release_date" : "2024-07-12T00:00:00Z",
    "advisory" : "RHSA-2024:4522",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.4::el9",
    "package" : "automation-controller-0:4.5.8-1.el9ap"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:3267",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "idm:client-8100020240417004735.143e9e98"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:3267",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "idm:DL1-8100020240416171943.823393f5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2559",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "python-jwcrypto-0:0.8-5.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "python-jwcrypto",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-28102\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-28102\nhttps://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f\nhttps://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97" ],
  "name" : "CVE-2024-28102",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}