CVE-2024-21319
published 2024-01-09CVE-2024-21319: Microsoft Identity Denial of service vulnerability
PriorityP428medium6.8CVSS 3.1
AVNACLPRHUINSCCNINAH
EPSS
2.87%
85.2th percentile
Microsoft Identity Denial of service vulnerability
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-jose | — | — |
| github.com | lestrrat-go_jwx | >= 0 < 1.2.29 | 1.2.29 |
| github.com | lestrrat-go_jwx_v2 | >= 0 < 2.0.21 | 2.0.21 |
| latchset | jwcrypto | >= 0 < 1.5.6 | 1.5.6 |
| microsoft | identity_model | >= 5.0.0 < 5.7.0 | 5.7.0 |
| microsoft | identity_model | >= 6.0.0 < 6.34.0 | 6.34.0 |
| microsoft | identity_model | >= 7.0.0 < 7.1.2 | 7.1.2 |
| microsoft | net | >= 6.0.0 < 6.0.26 | 6.0.26 |
| microsoft | net | >= 7.0.0 < 7.0.15 | 7.0.15 |
| microsoft | net | >= 8.0.0 < 8.0.1 | 8.0.1 |
| microsoft | visual_studio_2022 | >= 17.2.0 < 17.2.23 | 17.2.23 |
| microsoft | visual_studio_2022 | >= 17.4.0 < 17.4.15 | 17.4.15 |
| microsoft | visual_studio_2022 | >= 17.6.0 < 17.6.11 | 17.6.11 |
| microsoft | visual_studio_2022 | >= 17.8.0 < 17.8.4 | 17.8.4 |
| msrc | microsoft_identity_model_v5.0.0 | — | — |
| msrc | microsoft_identity_model_v5.0.0_for_nuget | — | — |
| msrc | microsoft_identity_model_v6.0.0 | — | — |
| msrc | microsoft_identity_model_v6.0.0_for_nuget | — | — |
| msrc | microsoft_identity_model_v7.0.0 | — | — |
| msrc | microsoft_identity_model_v7.0.0_for_nuget | — | — |
| msrc | microsoft_visual_studio_2022_version_17.2 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.4 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.6 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.8 | — | — |
| msrc | net_6.0 | — | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
ghsa6.8MEDIUM
osv9.8CRITICAL
vendor_ubuntu9.1CRITICAL
vendor_debian6.8MEDIUM
vendor_msrc6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIDIS Prime
cisa_ics·2025-04-10
Siemens SIDIS Prime
ICS Advisory
##
Siemens SIDIS Prime
Release DateApril 10, 2025
Alert CodeICSA-25-100-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIDIS Prime
- Vulnerabilities: Race Condition Enabling Link Following, Improper Validation of Integrity Check Value, Unchecked Input for Loo
Red Hat
python-jose: allows attackers to cause a denial of service
vendor_redhat·2024-04-26·CVSS 6.8
CVE-2024-33664 [MEDIUM] python-jose: allows attackers to cause a denial of service
python-jose: allows attackers to cause a denial of service
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
Package: automation-controller (Red Hat Ansible Automation Platform 2) - Not affected
Package: python-jose (Red Hat Ansible Automation Platform 2) - Not affected
Ubuntu
.NET vulnerabilities
vendor_ubuntu·2024-01-11·CVSS 9.1
CVE-2024-0057 [CRITICAL] .NET vulnerabilities
Title: .NET vulnerabilities
Summary: Several security issues were fixed in dotnet6, dotnet7, and dotnet8.
Vishal Mishra and Anita Gaud discovered that .NET did not properly
validate X.509 certificates with malformed signatures. An attacker
could possibly use this issue to bypass an application's typical
authentication logic.
(CVE-2024-0057)
Morgan Brown discovered that .NET did not properly handle requests from
unauthenticated clients. An attacker could possibly use this issue to
cause a denial of service.
(CVE-2024-21319)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
dotnet: .NET Denial of Service Vulnerability
vendor_redhat·2024-01-10·CVSS 6.8
CVE-2024-21319 [MEDIUM] CWE-400 dotnet: .NET Denial of Service Vulnerability
dotnet: .NET Denial of Service Vulnerability
Microsoft Identity Denial of service vulnerability
A Denial of Service vulnerability was found in .NET Core project templates that utilize JWT-based authentication tokens. This issue may allow an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and making the server no longer able to respond to legitimate requests.
Statement: This DoS vulnerability in .NET Core project templates utilizing JWT-based authentication tokens is considered a moderate issue due to its restricted impact. While unauthenticated clients can exploit the server's memory, potentially causing an out-of-memory condition and service disruption, the vulnerability does not lead to remot
Microsoft
Microsoft Identity Denial of service vulnerability
vendor_msrc·2024-01-09·CVSS 6.8
CVE-2024-21319 [MEDIUM] CWE-20 Microsoft Identity Denial of service vulnerability
Microsoft Identity Denial of service vulnerability
FAQ: According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?
The attacker must have access to the public encrypt key registered with the IDP(Entra ID) for successful exploitation.
FAQ: How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition.
It's important to note that the attacker must have access to the public key registered with the IDP(AAD) for successful exploitation.
FAQ: According to the CVSS
Debian
CVE-2024-33664: python-jose - python-jose through 3.3.0 allows attackers to cause a denial of service (resourc...
vendor_debian·2024·CVSS 6.8
CVE-2024-33664 [MEDIUM] CVE-2024-33664: python-jose - python-jose through 3.3.0 allows attackers to cause a denial of service (resourc...
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
Scope: local
bookworm: open
OSV
python-jose denial of service via compressed JWE content
osv·2024-04-26·CVSS 6.8
CVE-2024-33664 [MEDIUM] python-jose denial of service via compressed JWE content
python-jose denial of service via compressed JWE content
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
GHSA
python-jose denial of service via compressed JWE content
ghsa·2024-04-26·CVSS 6.8
CVE-2024-33664 [MEDIUM] CWE-400 python-jose denial of service via compressed JWE content
python-jose denial of service via compressed JWE content
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
OSV
CVE-2024-33664: python-jose through 3
osv·2024-04-26·CVSS 6.8
CVE-2024-33664 [MEDIUM] CVE-2024-33664: python-jose through 3
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
GHSA
JWX vulnerable to a denial of service attack using compressed JWE message
ghsa·2024-03-08
CVE-2024-28122 [MEDIUM] CWE-400 JWX vulnerable to a denial of service attack using compressed JWE message
JWX vulnerable to a denial of service attack using compressed JWE message
### Summary
This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression.
### Details
**The attacker needs to obtain a valid public key to compress the payload**. It needs to be valid so that the recipient can use to successfully decompress the payload. Furthermore in context JWT processing in the v2 versions, the recipient must explicitly allow JWE handling .
The attacker then crafts a message with high compression ratio, e.g. a payloa
OSV
JWX vulnerable to a denial of service attack using compressed JWE message
osv·2024-03-08
CVE-2024-28122 [MEDIUM] JWX vulnerable to a denial of service attack using compressed JWE message
JWX vulnerable to a denial of service attack using compressed JWE message
### Summary
This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression.
### Details
**The attacker needs to obtain a valid public key to compress the payload**. It needs to be valid so that the recipient can use to successfully decompress the payload. Furthermore in context JWT processing in the v2 versions, the recipient must explicitly allow JWE handling .
The attacker then crafts a message with high compression ratio, e.g. a payloa
OSV
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
osv·2024-03-06
CVE-2024-28102 [MEDIUM] JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
## Affected version
Vendor: https://github.com/latchset/jwcrypto
Version: 1.5.5
## Description
An attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio.
When the server processes this Token, it will consume a lot of memory and processing time.
## Poc
```python
from jwcrypto import jwk, jwe
from jwcrypto.common import json_encode, json_decode
import time
public_key = jwk.JWK()
private_key = jwk.JWK.generate(kty='RSA', size=2048)
public_key.import_key(**json_decode(private_key.export_public()))
payload = '{"u": "' + "u" * 400000000 + '", "uu":"' + "u" * 400000000 + '"}'
protected_header = {
"alg": "RSA-OAEP-256",
"enc": "A256CBC-HS512",
"typ": "JWE",
"zip": "DEF",
"kid": public_k
GHSA
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
ghsa·2024-03-06
CVE-2024-28102 [MEDIUM] CWE-770 JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
## Affected version
Vendor: https://github.com/latchset/jwcrypto
Version: 1.5.5
## Description
An attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio.
When the server processes this Token, it will consume a lot of memory and processing time.
## Poc
```python
from jwcrypto import jwk, jwe
from jwcrypto.common import json_encode, json_decode
import time
public_key = jwk.JWK()
private_key = jwk.JWK.generate(kty='RSA', size=2048)
public_key.import_key(**json_decode(private_key.export_public()))
payload = '{"u": "' + "u" * 400000000 + '", "uu":"' + "u" * 400000000 + '"}'
protected_header = {
"alg": "RSA-OAEP-256",
"enc": "A256CBC-HS512",
"typ": "JWE",
"zip": "DEF",
"kid": public_k
OSV
dotnet6, dotnet7, dotnet8 vulnerabilities
osv·2024-01-11·CVSS 9.8
CVE-2024-0057 [CRITICAL] dotnet6, dotnet7, dotnet8 vulnerabilities
dotnet6, dotnet7, dotnet8 vulnerabilities
Vishal Mishra and Anita Gaud discovered that .NET did not properly
validate X.509 certificates with malformed signatures. An attacker
could possibly use this issue to bypass an application's typical
authentication logic.
(CVE-2024-0057)
Morgan Brown discovered that .NET did not properly handle requests from
unauthenticated clients. An attacker could possibly use this issue to
cause a denial of service.
(CVE-2024-21319)
OSV
Microsoft ASP.NET Core project templates vulnerable to denial of service
osv·2024-01-09
CVE-2024-21319 [MEDIUM] Microsoft ASP.NET Core project templates vulnerable to denial of service
Microsoft ASP.NET Core project templates vulnerable to denial of service
A Denial of Service vulnerability exists in ASP.NET Core project templates which utilize JWT-based authentication tokens. This vulnerability allows an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and making the server no longer able to respond to legitimate requests.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/290
### Mitigation factors
This impacts only .NET Core-based projects that were created using any version of project templates listed in affected software.
Other project templates e.g., console applications, MAUI applications, Windows Forms or WPF ap
OSV
CVE-2024-21319: Microsoft Identity Denial of service vulnerability
osv·2024-01-09·CVSS 6.8
CVE-2024-21319 [MEDIUM] CVE-2024-21319: Microsoft Identity Denial of service vulnerability
Microsoft Identity Denial of service vulnerability
GHSA
Microsoft ASP.NET Core project templates vulnerable to denial of service
ghsa·2024-01-09
CVE-2024-21319 [MEDIUM] CWE-400 Microsoft ASP.NET Core project templates vulnerable to denial of service
Microsoft ASP.NET Core project templates vulnerable to denial of service
A Denial of Service vulnerability exists in ASP.NET Core project templates which utilize JWT-based authentication tokens. This vulnerability allows an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and making the server no longer able to respond to legitimate requests.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/290
### Mitigation factors
This impacts only .NET Core-based projects that were created using any version of project templates listed in affected software.
Other project templates e.g., console applications, MAUI applications, Windows Forms or WPF ap
No detection rules found.
No public exploits indexed.
Trendmicro
The January 2024 Security Update Review
blogs_trendmicro·2024-01-09·CVSS 8.8
[HIGH] The January 2024 Security Update Review
# The January 2024 Security Update Review
Get the January 2024 security update and review.
By: Dustin Childs
2024/01/09
Read time: ( words)
Save to Folio
Welcome to the first patch Tuesday of 2024. As expected, Microsoft and Adobe have released their latest security patches. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
Adobe Patches for January 2024
For January, Adobe released a single patch addressing six CVEs in Substance 3D Stager. All six bugs are rated Important with the most severe allowing arbitrary code execution.
None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Adobe categorizes t
Trendmicro
The January 2024 Security Update Review
blogs_trendmicro·2024-01-09·CVSS 9.1
[CRITICAL] The January 2024 Security Update Review
## The January 2024 Security Update Review
Get the January 2024 security update and review.
By: Dustin Childs Jan 09, 2024 Read time: ( words)
Save to Folio
Welcome to the first patch Tuesday of 2024. As expected, Microsoft and Adobe have released their latest security patches. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-20700
Windows Hyper-V Remote Code Execution Vulnerability
Critical
7.5
No
No
RCE
CVE-2024-20674
Windows Kerberos Security Feature Bypass Vulnerability
Critical
9
No
No
SFB
CVE-2024-0057
.NET and Visual Studio Framework Security Feature Bypass Vulnerability
Important
Trendmicro
The January 2024 Security Update Review
blogs_trendmicro·2024-01-09·CVSS 9.1
[CRITICAL] The January 2024 Security Update Review
## The January 2024 Security Update Review
Get the January 2024 security update and review.
By: Dustin Childs 2024/01/09 Read time: ( words)
Save to Folio
Welcome to the first patch Tuesday of 2024. As expected, Microsoft and Adobe have released their latest security patches. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-20700
Windows Hyper-V Remote Code Execution Vulnerability
Critical
7.5
No
No
RCE
CVE-2024-20674
Windows Kerberos Security Feature Bypass Vulnerability
Critical
9
No
No
SFB
CVE-2024-0057
.NET and Visual Studio Framework Security Feature Bypass Vulnerability
Important
8
Bleepingcomputer
Microsoft January 2024 Patch Tuesday fixes 49 flaws, 12 RCE bugs
blogs_bleepingcomputer·2024-01-09·CVSS 8.8
[HIGH] Microsoft January 2024 Patch Tuesday fixes 49 flaws, 12 RCE bugs
## Microsoft January 2024 Patch Tuesday fixes 49 flaws, 12 RCE bugs
## Lawrence Abrams
10 Elevation of Privilege Vulnerabilities
7 Security Feature Bypass Vulnerabilities
12 Remote Code Execution Vulnerabilities
11 Information Disclosure Vulnerabilities
6 Denial of Service Vulnerabilities
3 Spoofing Vulnerabilities
The total count of 49 flaws does not include 4 Microsoft Edge flaws fixed on January 5th.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5034123 cumulative update and Windows 10 KB5034122 update .
## This month's interesting flaws
While there were no actively exploited or publicly disclosed vulnerabilities this month, some flaws are more interesting than others.
Microsoft fixes an Office Remo
Trendmicro
The January 2024 Security Update Review
blogs_trendmicro·2024-01-09·CVSS 9.1
[CRITICAL] The January 2024 Security Update Review
## The January 2024 Security Update Review
Get the January 2024 security update and review.
By: Dustin Childs Jan 09, 2024 Read time: ( words)
Save to Folio
Welcome to the first patch Tuesday of 2024. As expected, Microsoft and Adobe have released their latest security patches. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-20700
Windows Hyper-V Remote Code Execution Vulnerability
Critical
7.5
No
No
RCE
CVE-2024-20674
Windows Kerberos Security Feature Bypass Vulnerability
Critical
9
No
No
SFB
CVE-2024-0057
.NET and Visual Studio Framework Security Feature Bypass Vulnerability
Important
Bugzilla
CVE-2024-33664 python-jose: allows attackers to cause a denial of service
bugzilla·2024-04-26·CVSS 6.8
CVE-2024-33664 [MEDIUM] CVE-2024-33664 python-jose: allows attackers to cause a denial of service
CVE-2024-33664 python-jose: allows attackers to cause a denial of service
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
https://github.com/mpdavis/python-jose/issues/344
https://github.com/mpdavis/python-jose/pull/345
Discussion:
Created python-jose tracking bugs for this issue:
Affects: fedora-all [bug 2277301]
2024-01-09
Published