The version of python-jwcrypto installed on the remote host is prior to 0.4.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2763 advisory.

    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an     attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression     ratio. When the server processes this token, it will consume a lot of memory and processing time. Version     1.5.6 fixes this vulnerability by limiting the maximum token length.

    NOTE: https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97NOTE:
    https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f (v1.5.6)     (CVE-2024-28102)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an     attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression     ratio. When the server processes this token, it will consume a lot of memory and processing time. Version     1.5.6 fixes this vulnerability by limiting the maximum token length. (CVE-2024-28102)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8409:01 advisory.

    * JWCrypto: denail of service Via specifically crafted JWE (CVE-2023-6681)
      * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3883 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3883-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     September 09, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-jwcrypto     Version        : 0.8.0-1+deb11u1     CVE ID         : CVE-2024-28102     Debian Bug     : 1065688

    It was discovered that there was a potential denial of service (DoS)     attack in python-jwcrypto, an implementation of JSON Web Encryption     and similar object signing standards.

    This could have been exploited by passing python-jwcrypto a malicious     JWE token with a high compression ratio. When the server processed     said token, it would have consumed a lot of memory and processing     time.

    For Debian 11 bullseye, this problem has been fixed in version     0.8.0-1+deb11u1.

    We recommend that you upgrade your python-jwcrypto packages.

    For the detailed security status of python-jwcrypto please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-jwcrypto

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3267 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * JWCrypto: denail of service  Via specifically crafted JWE (CVE-2023-6681)

    * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:2559 advisory.

  - JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an     attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression     ratio. When the server processes this token, it will consume a lot of memory and processing time. Version     1.5.6 fixes this vulnerability by limiting the maximum token length. (CVE-2024-28102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
216811	Amazon Linux 2 : python-jwcrypto (ALAS-2025-2763)	Nessus	Amazon Linux Local Security Checks	2025/2/26	2025/12/23	medium
252859	Linux Distros Unpatched Vulnerability : CVE-2024-28102	Nessus	Misc.	2025/8/20	2026/6/30	medium
291931	MiracleLinux 8 : idm:client (AXSA:2024-8409:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
206778	Debian dla-3883 : python3-jwcrypto - security update	Nessus	Debian Local Security Checks	2024/9/9	2025/12/23	medium
210497	RHEL 8 : idm:DL1 and idm:client (RHSA-2024:3267)	Nessus	Red Hat Local Security Checks	2024/11/7	2025/12/23	medium
196953	Rocky Linux 9 : python-jwcrypto (RLSA-2024:2559)	Nessus	Rocky Linux Local Security Checks	2024/5/14	2025/12/23	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium