python-jose algorithm confusion with OpenSSH ECDSA keys · CVE-2024-33663 · GitHub Advisory Database · GitHub

python-jose algorithm confusion with OpenSSH ECDSA keys

High severity GitHub Reviewed Published Apr 26, 2024 to the GitHub Advisory Database • Updated Sep 3, 2024

Package

python-jose (pip)

Affected versions

<= 3.3.0

Patched versions

None

Description

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

References

Published by the National Vulnerability Database

Apr 26, 2024

Published to the GitHub Advisory Database Apr 26, 2024

Reviewed Apr 26, 2024

Last updated Sep 3, 2024