id: PYSEC-2024-104
modified: 2024-10-10T17:22:00.587279Z
published: 2024-02-12T14:15:00Z
aliases:
- CVE-2023-6681
- GHSA-cw2r-4p82-qv79
details: A vulnerability was found in JWCrypto. This flaw allows an attacker to cause
  a denial of service (DoS) attack and possible password brute-force and dictionary
  attacks to be more resource-intensive. This issue can result in a large amount of
  computational consumption, causing a denial of service attack.
affected:
- package:
    ecosystem: PyPI
    name: jwcrypto
    purl: pkg:pypi/jwcrypto
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.5.1
  versions:
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 0.3.1
  - 0.4.0
  - 0.4.1
  - 0.4.2
  - 0.5.0
  - 0.6.0
  - "0.7"
  - "0.8"
  - "0.9"
  - 0.9.1
  - "1.0"
  - "1.2"
  - "1.3"
  - 1.3.1
  - "1.4"
  - 1.4.1
  - 1.4.2
  - 1.5.0
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
references:
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2023-6681
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2260843
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2024:3267
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cw2r-4p82-qv79