Amazon Linux 2 Security Advisory: ALAS-2025-2763
Advisory Release Date: 2025-02-12 23:17 Pacific
Advisory Updated Date: 2025-02-25 10:30 Pacific
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
NOTE: https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97
NOTE: https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f (v1.5.6) (CVE-2024-28102)
Affected Packages:
python-jwcrypto
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update python-jwcrypto to update your system.
noarch:
python-jwcrypto-0.4.2-1.amzn2.0.2.noarch
src:
python-jwcrypto-0.4.2-1.amzn2.0.2.src