A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8410:01 advisory.

    * JWCrypto: denail of service Via specifically crafted JWE (CVE-2023-6681)
      * python-jwcrypto: malicious JWE token can cause denial of service     (CVE-2024-28102)     CVE-2023-50387     Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and     related RFCs) allow remote attackers to cause a denial of service (CPU     consumption) via one or more DNSSEC responses, aka the KeyTrap issue. One of     the concerns is that, when there is a zone with many DNSKEY and RRSIG records,     the protocol specification implies that an algorithm must evaluate all     combinations of DNSKEY and RRSIG records.
    CVE-2023-6681     A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a     denial of service (DoS) attack and possible password brute-force and dictionary     attacks to be more resource-intensive. This issue can result in a large amount     of computational consumption, causing a denial of service attack.
    CVE-2024-28102     JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
    Prior to version 1.5.6, an attacker can cause a denial of service attack by     passing in a malicious JWE Token with a high compression ratio. When the server     processes this token, it will consume a lot of memory and processing time.
    Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
    Modularity name: idm     Stream name: DL1

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-9264:02 advisory.

    * JWCrypto: denail of service Via specifically crafted JWE (CVE-2023-6681)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8409:01 advisory.

    * JWCrypto: denail of service Via specifically crafted JWE (CVE-2023-6681)
      * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0814 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-6681:
    A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS)     attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue     can result in a large amount of computational consumption, causing a denial of service attack.

    CVE-2024-28102:
    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an     attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression     ratio. When the server processes this token, it will consume a lot of memory and processing time. Version     1.5.6 fixes this vulnerability by limiting the maximum token length.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0305 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-6681:
    A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS)     attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue     can result in a large amount of computational consumption, causing a denial of service attack.

    CVE-2024-28102:
    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an     attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression     ratio. When the server processes this token, it will consume a lot of memory and processing time. Version     1.5.6 fixes this vulnerability by limiting the maximum token length.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:9281 advisory.

    * JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS)     attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue     can result in a large amount of computational consumption, causing a denial of service attack.
    (CVE-2023-6681)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-9281 advisory.

    [1.5.6-2]
    - Disable auto-generation of dependencies       Related: RHEL-34809

    [1.5.6-1]
    - Rebase to version 1.5.6       Resolve: RHEL-34809

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9281 advisory.

    The python-jwcrypto package provides Python implementations of the JSON Web Key (JWK), JSON Web Signature     (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT) JOSE (JSON Object Signing and Encryption)     standards.

    Security Fix(es):

    * JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3267 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)

    * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3267 advisory.

    * JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)

    * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3267 advisory.

    bind-dyndb-ldap     custodia     ipa     [4.9.13-9.0.1]
    - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]

    [9.4.13-9]
    - dcerpc: invalidate forest trust intfo cache when filtering out realm domains       Resolves: RHEL-28559
    - Backport latests test fixes in python3-tests       ipatests: add xfail for autoprivate group test with override       ipatests: remove xfail thanks to sssd 2.9.4       ipatests: adapt for new automembership fixup behavior       ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases       test_xmlrpc: adopt to automember plugin message changes in 389-ds       Resolves: RHEL-29908

    ipa-healthcheck     opendnssec     python-jwcrypto     [0.5.0-2]
    - Address potential DoS with high compression ratio       Resolves: RHEL-28697
    - Limit number of iterations for PBES       Resolves: RHEL-23036 RHEL-23037

    python-kdcproxy     python-qrcode     python-yubico     pyusb     slapi-nis     softhsm

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-jwcrypto installed on the remote host is prior to 0.4.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2506 advisory.

    A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS)     attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue     can result in a large amount of computational consumption, causing a denial of service attack.
    (CVE-2023-6681)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
293162	MiracleLinux 8 : idm:DL1 (AXSA:2024-8410:01)	Nessus	Miracle Linux Local Security Checks	high
292778	MiracleLinux 9 : python-jwcrypto-1.5.6-2.el9 (AXSA:2024-9264:02)	Nessus	Miracle Linux Local Security Checks	medium
291931	MiracleLinux 8 : idm:client (AXSA:2024-8409:01)	Nessus	Miracle Linux Local Security Checks	medium
239179	TencentOS Server 4: python-jwcrypto (TSSA-2024:0814)	Nessus	Tencent Local Security Checks	medium
238804	TencentOS Server 3: idm:DL1 and idm:client (TSSA-2024:0305)	Nessus	Tencent Local Security Checks	medium
232874	RockyLinux 9 : python-jwcrypto (RLSA-2024:9281)	Nessus	Rocky Linux Local Security Checks	medium
225838	Linux Distros Unpatched Vulnerability : CVE-2023-6681	Nessus	Misc.	medium
211528	Oracle Linux 9 : python-jwcrypto (ELSA-2024-9281)	Nessus	Oracle Linux Local Security Checks	medium
210781	RHEL 9 : python-jwcrypto (RHSA-2024:9281)	Nessus	Red Hat Local Security Checks	medium
210497	RHEL 8 : idm:DL1 and idm:client (RHSA-2024:3267)	Nessus	Red Hat Local Security Checks	medium
200599	Rocky Linux 8 : idm:DL1 and idm:client (RLSA-2024:3267)	Nessus	Rocky Linux Local Security Checks	medium
198278	Oracle Linux 8 : idm:DL1 / and / idm:client (ELSA-2024-3267)	Nessus	Oracle Linux Local Security Checks	medium
192743	Amazon Linux 2 : python-jwcrypto (ALAS-2024-2506)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-6681

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium