python3.11-pyjwt+crypto vulnerabilities (Red Hat)
12 vulnerabilities.
-
python3.11-pyjwt+cryptoRed Hat Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` 8.2 High -
python3.11-pyjwt+cryptoRed Hat Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading 7.5 High -
python3.11-pyjwt+cryptoRed Hat Pillow GdImageFile decompression bomb protection bypass 7.5 High -
python3.11-pyjwt+cryptoRed Hat Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` 7.5 High -
python3.11-pyjwt+cryptoRed Hat Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading 7.5 High -
python3.11-pyjwt+cryptoRed Hat Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters 7.5 High -
python3.11-pyjwt+cryptoRed Hat Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception 1.7 Low -
python3.11-pyjwt+cryptoRed Hat Katello: missing repository authorization in content_uploads exposes cross-product content existence 4.3 Medium -
python3.11-pyjwt+cryptoRed Hat PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed 7.4 High -
python3.11-pyjwt+cryptoRed Hat Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data 7.8 High -
python3.11-pyjwt+cryptoRed Hat HTTP Request Smuggling via Chunked Extension Quoted-String Parsing 7.4 High -
python3.11-pyjwt+cryptoRed Hat Out-of-bounds read & write in RFC 3211 KEK Unwrap 9.8 Critical