Read the docs
TI-2023-06111 Aliases CVE-2023-6681GHSA-cw2r-4p82-qv79

Jwcrypto: denail of service via specifically crafted jwe

Priority LOW 26CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00884 59th percentileScored 2026-11-07
Fix Partial jwcrypto (PyPI): 1.5.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Enterprise Linux 8—8100020240417004735.143e9e98Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020240416171943.823393f5Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.5.6-2.el9Patch availableCNA
Red HatRed Hat Ansible Automation Platform 2——Not affectedCNA
Red HatRed Hat Enterprise Linux 7——No fix listedCNA
—jwcrypto (PyPI)before 1.5.11.5.1Patch availableGHSA-cw2r-4p82-qv79
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020240417004735.143e9e98 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020240416171943.823393f5 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.5.6-2.el9 Patch available CNA
  • Red Hat Ansible Automation Platform 2 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • jwcrypto (PyPI) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-cw2r-4p82-qv79

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*before 1.5.1Vulnerablelatchset
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:* Versions before 1.5.1 Vulnerable ·latchset
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-cw2r-4p82-qv79 jwcrypto (PyPI) Fixed in 1.5.1 Advisory →

Red Hat 2 advisories

  • RHSA-2024:9281 Released 2024-11-12 · Red Hat rating Moderate
    python-jwcrypto security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-jwcrypto-1.5.6-2.el9, python3-jwcrypto-1.5.6-2.el9
  • RHSA-2024:3267 Released 2024-05-22 · Red Hat rating Moderate
    idm:DL1 and idm:client security update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.aarch64::idm:DL1, bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.s390x::idm:DL1 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:3267
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:9281
Not affected: 1 product
  • Red Hat Ansible Automation Platform 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6681
  2. 2026-10-03 Alias added: GHSA-cw2r-4p82-qv79

References

Advisory 5

Other 4

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences