The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an     attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression     ratio. When the server processes this token, it will consume a lot of memory and processing time. Version     1.5.6 fixes this vulnerability by limiting the maximum token length. (CVE-2024-28102)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8410:01 advisory.

    * JWCrypto: denail of service Via specifically crafted JWE (CVE-2023-6681)
      * python-jwcrypto: malicious JWE token can cause denial of service     (CVE-2024-28102)     CVE-2023-50387     Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and     related RFCs) allow remote attackers to cause a denial of service (CPU     consumption) via one or more DNSSEC responses, aka the KeyTrap issue. One of     the concerns is that, when there is a zone with many DNSKEY and RRSIG records,     the protocol specification implies that an algorithm must evaluate all     combinations of DNSKEY and RRSIG records.
    CVE-2023-6681     A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a     denial of service (DoS) attack and possible password brute-force and dictionary     attacks to be more resource-intensive. This issue can result in a large amount     of computational consumption, causing a denial of service attack.
    CVE-2024-28102     JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
    Prior to version 1.5.6, an attacker can cause a denial of service attack by     passing in a malicious JWE Token with a high compression ratio. When the server     processes this token, it will consume a lot of memory and processing time.
    Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
    Modularity name: idm     Stream name: DL1

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3267 advisory.

    * JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)

    * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3883 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3883-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     September 09, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-jwcrypto     Version        : 0.8.0-1+deb11u1     CVE ID         : CVE-2024-28102     Debian Bug     : 1065688

    It was discovered that there was a potential denial of service (DoS)     attack in python-jwcrypto, an implementation of JSON Web Encryption     and similar object signing standards.

    This could have been exploited by passing python-jwcrypto a malicious     JWE token with a high compression ratio. When the server processed     said token, it would have consumed a lot of memory and processing     time.

    For Debian 11 bullseye, this problem has been fixed in version     0.8.0-1+deb11u1.

    We recommend that you upgrade your python-jwcrypto packages.

    For the detailed security status of python-jwcrypto please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-jwcrypto

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3267 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)

    * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:2559 advisory.

  - JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an     attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression     ratio. When the server processes this token, it will consume a lot of memory and processing time. Version     1.5.6 fixes this vulnerability by limiting the maximum token length. (CVE-2024-28102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
252859	Linux Distros Unpatched Vulnerability : CVE-2024-28102	Nessus	Misc.	8/20/2025	8/19/2026	medium
293162	MiracleLinux 8 : idm:DL1 (AXSA:2024-8410:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
200599	Rocky Linux 8 : idm:DL1 and idm:client (RLSA-2024:3267)	Nessus	Rocky Linux Local Security Checks	6/14/2024	12/23/2025	medium
206778	Debian dla-3883 : python3-jwcrypto - security update	Nessus	Debian Local Security Checks	9/9/2024	12/23/2025	medium
210497	RHEL 8 : idm:DL1 and idm:client (RHSA-2024:3267)	Nessus	Red Hat Local Security Checks	11/7/2024	12/23/2025	medium
196953	Rocky Linux 9 : python-jwcrypto (RLSA-2024:2559)	Nessus	Rocky Linux Local Security Checks	5/14/2024	12/23/2025	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

medium