CVE-2024-33663 - Vulnerability Details - OpenCVE

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Redhat	Ansible Automation Platform

No data.

Package	CPE	Advisory	Released Date
Red Hat Ansible Automation Platform 2.4 for RHEL 8
automation-controller-0:4.5.10-1.el8ap	cpe:/a:redhat:ansible_automation_platform:2.4::el8	RHSA-2024:6428	2024-09-05T00:00:00Z
Red Hat Ansible Automation Platform 2.4 for RHEL 9
automation-controller-0:4.5.10-1.el9ap	cpe:/a:redhat:ansible_automation_platform:2.4::el9	RHSA-2024:6428	2024-09-05T00:00:00Z

References

Link	Providers
https://github.com/mpdavis/python-jose/issues/346
https://nvd.nist.gov/vuln/detail/CVE-2024-33663
https://www.cve.org/CVERecord?id=CVE-2024-33663
https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663

History

Sun, 08 Sep 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat ansible Automation Platform
CPEs		cpe:/a:redhat:ansible_automation_platform:2.4::el8 cpe:/a:redhat:ansible_automation_platform:2.4::el9
Vendors & Products		Redhat Redhat ansible Automation Platform

Mon, 19 Aug 2024 08:30:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:python-jose_project:python-jose::::::::
Vendors & Products	Python-jose Project Python-jose Project python-jose
References		https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-25T00:00:00

Updated: 2024-09-03T19:34:19.749577

Reserved: 2024-04-25T00:00:00

Link: CVE-2024-33663

Vulnrichment

Updated: 2024-08-19T07:38:26.262Z

NVD

Status : Awaiting Analysis

Published: 2024-04-26T00:15:09.010

Modified: 2024-11-21T09:17:21.073

Link: CVE-2024-33663

Redhat

Severity : Moderate

Publid Date: 2024-04-26T00:00:00Z

Links: CVE-2024-33663 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-33663", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-03T19:34:19.749577", "dateReserved": "2024-04-25T00:00:00", "datePublished": "2024-04-25T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-09-03T19:34:19.749577"}, "descriptions": [{"lang": "en", "value": "python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/mpdavis/python-jose/issues/346"}, {"url": "https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}], "affected": [{"vendor": "python-jose_project", "product": "python-jose", "cpes": ["cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.0", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-17T13:37:11.286073Z", "id": "CVE-2024-33663", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-17T13:45:02.277Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-19T07:38:26.262Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/mpdavis/python-jose/issues/346", "tags": ["x_transferred"]}, {"url": "https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663"}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/mpdavis/python-jose/issues/346", "tags": ["x_transferred"]}, {"url": "https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-19T07:38:26.262Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-33663", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-17T13:37:11.286073Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:*"], "vendor": "python-jose_project", "product": "python-jose", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-17T13:41:24.427Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/mpdavis/python-jose/issues/346"}, {"url": "https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663"}], "descriptions": [{"lang": "en", "value": "python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-09-03T19:34:19.749577"}}}, "cveMetadata": {"cveId": "CVE-2024-33663", "state": "PUBLISHED", "dateUpdated": "2024-09-03T19:34:19.749577", "dateReserved": "2024-04-25T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-25T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}