Vulnerability · Published Feb 12, 2024 · Assigned by redhat
CVE-2023-6681Jwcrypto: denail of service via specifically crafted jwe
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in Red Hat Ansible Automation Platform 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | python3-jwcrypto | 1.5.6-2.el9 | ALSA-2024:9281 |
| Alpine:v3.20 | py3-jwcrypto | 1.5.1-r0 | ALPINE-CVE-2023-6681 |
| Alpine:v3.21 | py3-jwcrypto | 1.5.1-r0 | ALPINE-CVE-2023-6681 |
| Alpine:v3.22 | py3-jwcrypto | 1.5.1-r0 | ALPINE-CVE-2023-6681 |
| Alpine:v3.23 | py3-jwcrypto | 1.5.1-r0 | ALPINE-CVE-2023-6681 |
| Alpine:v3.24 | py3-jwcrypto | 1.5.1-r0 | ALPINE-CVE-2023-6681 |
| Debian:12 | python-jwcrypto | no fix listed | DEBIAN-CVE-2023-6681 |
| Debian:13 | python-jwcrypto | 1.5.4-1 | DEBIAN-CVE-2023-6681 |
| Debian:14 | python-jwcrypto | 1.5.4-1 | DEBIAN-CVE-2023-6681 |
| PyPI | jwcrypto | 1.5.1 | GHSA-cw2r-4p82-qv79 |
| PyPI | jwcrypto | 1.5.1 | PYSEC-2024-104 |
| Rocky Linux:8 | bind-dyndb-ldap | 0:11.6-5.module+el8.10.0+1819+0aeba2f1 | RLSA-2024:3267 |
| Rocky Linux:8 | custodia | 0:0.6.0-3.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3267 |
| Rocky Linux:8 | ipa | 0:4.9.13-9.module+el8.10.0+1818+2dfda7a6 | RLSA-2024:3267 |
| Rocky Linux:8 | ipa-healthcheck | 0:0.12-3.module+el8.9.0+1433+5bd2f890 | RLSA-2024:3267 |
| Rocky Linux:8 | opendnssec | 0:2.1.7-1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3267 |
| Rocky Linux:8 | python-jwcrypto | 0:0.5.0-2.module+el8.10.0+1818+2dfda7a6 | RLSA-2024:3267 |
| Rocky Linux:9 | python-jwcrypto | 0:1.5.6-2.el9 | RLSA-2024:9281 |
| Rocky Linux:8 | python-kdcproxy | 0:0.4-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3267 |
| Rocky Linux:8 | python-qrcode | 0:5.1-12.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3267 |
| Rocky Linux:8 | python-yubico | 0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3267 |
| Rocky Linux:8 | pyusb | 0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3267 |
| Rocky Linux:8 | slapi-nis | 0:0.60.0-4.module+el8.9.0+1573+39ab85f4 | RLSA-2024:3267 |
| Rocky Linux:8 | softhsm | 0:2.6.0-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:3267 |
| Ubuntu:22.04:LTS | python-jwcrypto | no fix listed | UBUNTU-CVE-2023-6681 |
| Ubuntu:24.04:LTS | python-jwcrypto | no fix listed | UBUNTU-CVE-2023-6681 |
| Ubuntu:25.10 | python-jwcrypto | no fix listed | UBUNTU-CVE-2023-6681 |
| Ubuntu:26.04:LTS | python-jwcrypto | no fix listed | UBUNTU-CVE-2023-6681 |
| Ubuntu:26.10 | python-jwcrypto | no fix listed | UBUNTU-CVE-2023-6681 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- RHSA-2024:3267 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:9281 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-6681 vdb-entry, x_refsource_REDHAT
- RHBZ#2260843 issue-tracking, x_refsource_REDHAT