CVE-2023-6681

Name
CVE-2023-6681
Description
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://access.redhat.com/security/cve/CVE-2023-6681
issue-tracking https://bugzilla.redhat.com/show_bug.cgi?id=2260843
vendor-advisory https://access.redhat.com/errata/RHSA-2024:3267

Match rules

CPE URI Source package Min version Max version
cpe:/a:redhat:enterprise_linux:8::appstream shopxo >= 8100020240417004735.143e9e98 < *
cpe:/a:redhat:enterprise_linux:8::appstream shopxo >= 8100020240416171943.823393f5 < *

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
py3-jwcrypto edge-community 1.5.1-r0 prspkt <prspkt@protonmail.com> fixed
py3-jwcrypto 3.22-community 1.5.1-r0 None fixed
py3-jwcrypto 3.21-community 1.5.1-r0 None fixed
py3-jwcrypto 3.20-community 1.5.1-r0 None fixed
py3-jwcrypto 3.19-community 1.5.1-r0 prspkt <prspkt@protonmail.com> fixed