{"id":"CVE-2024-33663","aliases":["CLSA-2026-1769645545","DEBIAN-CVE-2024-33663","EUVD-2024-1121","GHSA-3qf3-8w2g-rqmx","GHSA-6c5p-j8vq-pqhj","PYSEC-2024-232","PYSEC-2026-4298","RHSA-2024:6428","UBUNTU-CVE-2024-33663","openSUSE-SU-2024:0118-1","openSUSE-SU-2024:13928-1"],"status":"published","title":"python-jose algorithm confusion with OpenSSH ECDSA keys","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00307,"percentile":0.23727,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327","CWE-347"],"published":"2024-04-25T00:00:00Z","modified":"2026-11-02T12:02:31Z","fixes":[{"ecosystem":"PyPI","package":"python-jose","fixed_in":["3.4.0"],"sources":["ghsa"]},{"ecosystem":"TuxCare:PyPI","package":"python-jose","fixed_in":["3.3.0.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"python-python-jose","fixed_in":["3.0.1-bp155.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-python-jose","fixed_in":["3.0.1-bp155.3.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.0.post2+tuxcare"}]}],"versions":["3.3.0","3.3.0.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+dfsg-4","3.3.0+dfsg-5"]},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.3.0","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.1","0.6.2","0.7.0","1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-zipp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.2-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58.3-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.15-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el8ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.10-1.el9ap"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+dfsg-4"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"python-python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-bp155.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-python-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-bp155.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-3.1"}]}],"bundled":2}],"products":[{"vendor":"python-jose_project","product":"python-jose"}],"references":[{"url":"https://github.com/mpdavis/python-jose/issues/346","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663","tags":["Exploit","Mitigation","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33663","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6c5p-j8vq-pqhj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33663.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85394.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85394","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/python-jose-through-3.5.0-algorithm-confusion-via-der-encoded-public-key-as-hmac-secret","tags":["advisory","web"]},{"url":"https://github.com/mpdavis/python-jose/issues/414","tags":["report","web"]},{"url":"https://github.com/mpdavis/python-jose","tags":["package"]},{"url":"https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/backends/native.py","tags":["article","web"]},{"url":"https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/utils.py","tags":["article","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-33663","tags":["advisory"]},{"url":"https://pypi.org/project/python-jose","tags":["package"]},{"url":"https://github.com/advisories/GHSA-3qf3-8w2g-rqmx","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6428","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295936","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2298492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302436","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6428.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5569","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5569","tags":["advisory"]},{"url":"https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd","tags":["article"]},{"url":"https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6840","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2303104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7246","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7246","tags":["advisory"]},{"url":"https://github.com/grpc/grpc/issues/36245","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32879","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32879","tags":["advisory"]},{"url":"https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-33663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-33663","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-38875","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38875","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39329","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39330","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39330","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-39614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39614","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41989","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41990","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/aug/06/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41991","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-42005","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42005","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-33663","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2ZVFD2FXHXWGBVAQ2KKX4NJMNLPY2AYI/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223417","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33663","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33664","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-33663","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-25T00:00:00Z","modified":"2024-09-03T19:34:19.749Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:34:21.404483Z"}],"euvd":[{"id":"EUVD-2024-1121","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-25T00:00:00Z","modified":"2024-09-03T19:34:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:05.029422Z"}],"ghsa":[{"id":"GHSA-6c5p-j8vq-pqhj","title":"python-jose algorithm confusion with OpenSSH ECDSA keys","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:30:35Z","modified":"2025-02-18T22:48:16Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:38:32.275316Z"}],"nvd":[{"id":"CVE-2024-33663","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:15:09.01Z","modified":"2026-06-17T07:32:11.28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-33663","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-25T00:00:00Z","modified":"2026-10-28T02:30:33.200550083Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"CVE-2026-85394","title":"python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T18:54:26.563Z","modified":"2026-10-28T02:30:49.314185303Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"DEBIAN-CVE-2024-33663","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:15:09.01Z","modified":"2026-11-02T12:02:31.388622273Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-3qf3-8w2g-rqmx","title":"python-jose algorithm confusion guard bypassed by DER-encoded public keys","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-09-03T21:31:15Z","modified":"2026-10-15T14:56:01.261338787Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"GHSA-6c5p-j8vq-pqhj","title":"python-jose algorithm confusion with OpenSSH ECDSA keys","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:30:35Z","modified":"2026-10-15T14:56:01.261338787Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"PYSEC-2026-4298","title":"python-jose algorithm confusion guard bypassed by DER-encoded public keys","description":"python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.","status":"published","published":"2026-10-15T10:22:43.820157Z","modified":"2026-10-15T14:56:01.261338787Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"RHSA-2024:6428","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:23:01Z","modified":"2026-10-17T10:03:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-33663","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:15:00Z","modified":"2025-09-08T17:00:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"CLSA-2026-1769645545","title":"TuxCare security update for python-jose (1 CVE)","description":"TuxCare rebuilt python-jose to address 1 CVE. Fixed in 3.3.0.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:47:58.733009366Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"openSUSE-SU-2024:0118-1","title":"Security update for python-python-jose","description":"This update for python-python-jose fixes the following issues:\n\nCVE-2024-33663: Fixed algorithm confusion with OpenSSH ECDSA keys and other key formats (boo#1223417).\n","status":"published","published":"2024-05-07T15:58:14Z","modified":"2026-02-04T03:29:01.209361Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13928-1","title":"python310-python-jose-3.3.0-3.1 on GA media","description":"These are all security issues fixed in the python310-python-jose-3.3.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:08:39.949242Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"PYSEC-2024-232","description":"python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.","status":"published","published":"2024-04-26T00:15:09Z","modified":"2026-10-15T14:56:01.261338787Z","updated_at":"2026-11-02T15:52:54.242332Z"}]}}