Every CVE Search/ Get API key

CVE-2024-33663

python-jose algorithm confusion with OpenSSH ECDSA keys

6.5 MediumFix available

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Apr 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.5

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
CVE-2024-33663
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-327
Updated
2026-11-02
EUVDEUVD-2024-1121 6.5

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
EUVD-2024-1121
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-6c5p-j8vq-pqhj 9.3

python-jose algorithm confusion with OpenSSH ECDSA keys

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
GHSA-6c5p-j8vq-pqhj
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-327
Updated
2026-11-02
NVD 6.5

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
CVE-2024-33663
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-327
Updated
2026-11-02
OSV 6.5

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
CVE-2024-33663
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVCVE-2026-85394 9.3

python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

Record
CVE-2026-85394
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-347
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2024-33663 6.5

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
DEBIAN-CVE-2024-33663
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-3qf3-8w2g-rqmx 9.3

python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

Record
GHSA-3qf3-8w2g-rqmx
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
OSVGHSA-6c5p-j8vq-pqhj 9.3

python-jose algorithm confusion with OpenSSH ECDSA keys

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
GHSA-6c5p-j8vq-pqhj
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-327
Updated
2026-11-02
OSVPYSEC-2026-4298 9.3

python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

Record
PYSEC-2026-4298
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2024:6428 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record
RHSA-2024:6428
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-33663 6.5

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
UBUNTU-CVE-2024-33663
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1769645545 No score

TuxCare security update for python-jose (1 CVE)

TuxCare rebuilt python-jose to address 1 CVE. Fixed in 3.3.0.post2+tuxcare.

Record
CLSA-2026-1769645545
Updated
2026-11-02
OSVopenSUSE-SU-2024:0118-1 No score

Security update for python-python-jose

This update for python-python-jose fixes the following issues:

CVE-2024-33663: Fixed algorithm confusion with OpenSSH ECDSA keys and other key formats (boo#1223417).

Record
openSUSE-SU-2024:0118-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13928-1 No score

python310-python-jose-3.3.0-3.1 on GA media

These are all security issues fixed in the python310-python-jose-3.3.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13928-1
Updated
2026-11-02
OSVPYSEC-2024-232 No score

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Record
PYSEC-2024-232
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-jose
PyPI
 before 3.4.0
3.4.0
python-jose
TuxCare:PyPI
 3.3.0 up to 3.3.0.post2+tuxcare, plus listed versions
3.3.0.post1+tuxcare
3.3.0.post2+tuxcare
python-jose
Debian:12
 All versions, plus listed versions
3.3.0+dfsg-43.3.0+dfsg-5
 None known
python-jose
PyPI
From an advisory covering 2 CVEs
 through 3.5.0, plus listed versions
0.1.00.1.10.1.20.1.30.1.4
Show 33 moreShow less
0.1.50.1.60.1.70.1.80.2.00.3.00.4.00.5.00.5.10.5.20.5.30.5.40.5.50.5.60.6.10.6.20.7.01.0.01.1.01.2.01.3.01.3.11.3.21.4.02.0.02.0.12.0.23.0.03.0.13.1.03.2.03.3.03.4.0
 None known
python-jose
PyPI
From an advisory covering 2 CVEs
 before 3.4.0, plus listed versions
0.1.00.1.10.1.20.1.30.1.4
Show 32 moreShow less
0.1.50.1.60.1.70.1.80.2.00.3.00.4.00.5.00.5.10.5.20.5.30.5.40.5.50.5.60.6.10.6.20.7.01.0.01.1.01.2.01.3.01.3.11.3.21.4.02.0.02.0.12.0.23.0.03.0.13.1.03.2.03.3.0
3.4.0
python39-zipp
Red Hat:ansible_automation_platform_developer:2.4::el8
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el8ap
0:3.19.2-1.el8ap
python39-zipp
Red Hat:ansible_automation_platform_inside:2.4::el8
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el8ap
0:3.19.2-1.el8ap
python39-zipp
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el8ap
0:3.19.2-1.el8ap
python-zipp
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el9ap
0:3.19.2-1.el9ap
python3-zipp
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el9ap
0:3.19.2-1.el9ap
Show 35 moreShow less
Affected packages
PackageAffectedFixed
python-zipp
Red Hat:ansible_automation_platform_inside:2.4::el9
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el9ap
0:3.19.2-1.el9ap
python3-zipp
Red Hat:ansible_automation_platform_inside:2.4::el9
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el9ap
0:3.19.2-1.el9ap
python-zipp
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el9ap
0:3.19.2-1.el9ap
python3-zipp
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:3.19.2-1.el9ap
0:3.19.2-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el8ap
0:4.5.10-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el9ap
0:4.5.10-1.el9ap
python39-grpcio
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el8ap
0:1.58.3-1.el8ap
python39-grpcio-debuginfo
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el8ap
0:1.58.3-1.el8ap
python3x-grpcio
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el8ap
0:1.58.3-1.el8ap
python3x-grpcio-debugsource
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el8ap
0:1.58.3-1.el8ap
python-grpcio
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el9ap
0:1.58.3-1.el9ap
python-grpcio-debugsource
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el9ap
0:1.58.3-1.el9ap
python3-grpcio
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el9ap
0:1.58.3-1.el9ap
python3-grpcio-debuginfo
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:1.58.3-1.el9ap
0:1.58.3-1.el9ap
python39-django
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.2.15-1.el8ap
0:4.2.15-1.el8ap
python3x-django
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.2.15-1.el8ap
0:4.2.15-1.el8ap
python-django
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.2.15-1.el9ap
0:4.2.15-1.el9ap
python3-django
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.2.15-1.el9ap
0:4.2.15-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el8ap
0:4.5.10-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el8ap
0:4.5.10-1.el8ap
automation-controller
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el8ap
0:4.5.10-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el8ap
0:4.5.10-1.el8ap
automation-controller-server
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el8ap
0:4.5.10-1.el8ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el8ap
0:4.5.10-1.el8ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el9ap
0:4.5.10-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el9ap
0:4.5.10-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el9ap
0:4.5.10-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el9ap
0:4.5.10-1.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el9ap
0:4.5.10-1.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 13 CVEs
 before 0:4.5.10-1.el9ap
0:4.5.10-1.el9ap
python-jose
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.3.0+dfsg-1
 None known
python-jose
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.3.0+dfsg-4
 None known
python-python-jose
SUSE:Package Hub 15 SP5
 before 3.0.1-bp155.3.3.1
3.0.1-bp155.3.3.1
python-python-jose
openSUSE:Leap 15.5
 before 3.0.1-bp155.3.3.1
3.0.1-bp155.3.3.1
python-cryptography
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.3.0-3.1
3.3.0-3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-33663 is a medium vulnerability (CVSS 6.5) in Python-jose Project Python-jose, published April 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in python-jose 3.4.0.

References

Show 74 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open