Skip to content

Fix for CVE-2024-33664. JWE limited to 250K - #352

Merged
asherf merged 9 commits into
mpdavis:masterfrom
alistairwatts:cve-2024-33664
Feb 6, 2025
Merged

Fix for CVE-2024-33664. JWE limited to 250K#352
asherf merged 9 commits into
mpdavis:masterfrom
alistairwatts:cve-2024-33664

Conversation

@alistairwatts

@alistairwattsalistairwatts commented May 7, 2024

Copy link
Copy Markdown
Contributor

This fix for CVE-2024-33664 ensures that any incoming JWE is under 250K, which seems to be a sensible, albeit large limit. The specific fix for the "zip bomb" issue ensures that we decompress no more that 250K of data. If that limit is reached then a JWEError is raised.

There's rough symmetry here ensuring that both compressed and uncompressed JWE data is no more than 250K.

@alistairwattsalistairwatts mentioned this pull request May 7, 2024
Open
@omufeed

omufeed commented May 8, 2024

Copy link
Copy Markdown

Is this repository still maintained? Would be great to check and merge this PR.

@Shinnnyshinshin

Shinnnyshinshin commented May 8, 2024

Copy link
Copy Markdown

Thank you for this work @alistairwatts. Would love to see this PR go in.

@CharlesPerrotMinot

CharlesPerrotMinot commented May 10, 2024

Copy link
Copy Markdown

Let's try pinging @asherf and @mpdavis

alistairwatts
alistairwatts commented May 15, 2024
View reviewed changes
Comment threadjose/jwe.py Outdated
# data could lead to large memory usage. This helps address This addresses
# CVE-2024-33664. Also see _decompress()
if len(jwe_str) > JWE_SIZE_LIMIT:
raise JWEError("JWE string exceeds {JWE_SIZE_LIMIT} bytes")

@alistairwattsalistairwattsMay 15, 2024

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be an f-string.

This was referenced May 21, 2024
Closed
Closed
@alistairwattsalistairwatts mentioned this pull request May 21, 2024
Closed
@smittysmee

smittysmee commented May 21, 2024

Copy link
Copy Markdown

@mpdavis

@maciejstromich

maciejstromich commented May 22, 2024

Copy link
Copy Markdown

if @mpdavis does not work maybe @michaeldavis-wf will?

@NatimNatim mentioned this pull request May 28, 2024
Merged
libo
libo reviewed May 29, 2024
View reviewed changes

@libolibo left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I fixed the missing f-string. @alistairwatts

Comment threadjose/jwe.py Outdated
@twwildey

twwildey commented May 30, 2024

Copy link
Copy Markdown
Collaborator

Can you rebase your changes onto the latest master branch and force-update your branch for this PR?

@nicholas-quirk-mass-gov

nicholas-quirk-mass-gov commented Jun 3, 2024

Copy link
Copy Markdown

@alistairwatts

bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Jun 3, 2024
dgarcia@bmwiedemann
Update python-python-jose to version 3.3.0 / rev 9 via SR 1178245
4b9828d
https://build.opensuse.org/request/show/1178245
by user dgarcia + anag+factory
- Update CVE-2024-33664.patch with upstream
mpdavis/python-jose#352
bsc#1223422
@CharlesPerrotMinot

CharlesPerrotMinot commented Jun 3, 2024

Copy link
Copy Markdown

@twwildey

@phasath

phasath commented Sep 20, 2024

Copy link
Copy Markdown

Any updates here?

@BEEFF

BEEFF commented Nov 13, 2024

Copy link
Copy Markdown

Right now we should be checking the length of the tokens at the API level whilst waiting for this fix? Dependabot brought me here.

asherf
asherf reviewed Feb 5, 2025
View reviewed changes
Comment threadjose/jwe.py Outdated
asherf
asherf reviewed Feb 5, 2025
View reviewed changes
Comment threadtests/test_jwe.py Outdated
asherf
asherf reviewed Feb 5, 2025
View reviewed changes
Comment threadtests/test_jwe.py Outdated
asherf
asherf reviewed Feb 6, 2025
View reviewed changes
Comment thread.github/workflows/ci.yml Outdated
asherf
asherf reviewed Feb 6, 2025
View reviewed changes
Comment thread.github/workflows/ci.yml Outdated
asherf
asherf reviewed Feb 6, 2025
View reviewed changes
Comment threadjose/jwe.py Outdated
asherf
asherf reviewed Feb 6, 2025
View reviewed changes
Comment threadtests/test_jwe.py Outdated
@asherf
asherf merged commit 8e1f521 into mpdavis:masterFeb 6, 2025
@coderabbitaicoderabbitaiBot mentioned this pull request Mar 19, 2026
Merged
This was referenced May 2, 2026
Open
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request May 16, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@asherfasherfasherf left review comments
+3 more reviewers
@libolibolibo left review comments
@ShinnnyshinshinShinnnyshinshinShinnnyshinshin approved these changes
@keith-oakkeith-oakkeith-oak approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

13 participants

@alistairwatts@omufeed@Shinnnyshinshin@CharlesPerrotMinot@smittysmee@maciejstromich@twwildey@nicholas-quirk-mass-gov@phasath@BEEFF@libo@asherf@keith-oak