Cryptographic issues in JOSE - CVE-2024-33663

Vulnerability identifier: #VU91833

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-33663

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to algorithm confusion with OpenSSH ECDSA keys and other key formats. A remote attacker can perform MitM attack.

JOSE
IBM Fusion HCI
Ansible Automation Platform
python3x-jmespath (Red Hat package)
python-jmespath (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
python3x-grpcio (Red Hat package)
python-grpcio (Red Hat package)
python-zipp (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python3x-django (Red Hat package)
python-django (Red Hat package)
automation-controller (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Maximo Application Suite - Edge Data Collector

Install updates from vendor's website.

IBM Fusion HCI - update to 2.10.0
python3x-jmespath (Red Hat package) - update to 0.10.0-5.el8ap
python-jmespath (Red Hat package) - update to 0.10.0-5.el9ap
python3x-pulp-ansible (Red Hat package) - update to 0.20.8-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.8-1.el9ap
python3x-grpcio (Red Hat package) - update to 1.58.3-1.el8ap
python-grpcio (Red Hat package) - update to 1.58.3-1.el9ap
Ansible Automation Platform - update to 2.4
python-zipp (Red Hat package) - update to 3.19.2-1.el9ap
python3x-pulpcore (Red Hat package) - update to 3.28.31-1.el8ap
python-pulpcore (Red Hat package) - update to 3.28.31-1.el9ap
python3x-django (Red Hat package) - update to 4.2.15-1.el8ap
python-django (Red Hat package) - update to 4.2.15-1.el9ap
automation-controller (Red Hat package) - addressed in versions 4.5.10-1.el8ap, 4.5.10-1.el9ap
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.12, 9.0.4
python3x-gunicorn (Red Hat package) - update to 22.0.0-2.el8ap
python-gunicorn (Red Hat package) - update to 22.0.0-2.el9ap

• https://github.com/mpdavis/python-jose/issues/346

• Algorithm confusion in python-jose
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• IBM Edge Data Collector update for python-jose
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for python-jose
• Multiple vulnerabilities in IBM Fusion