SB20260417149 - openEuler 24.03 LTS SP1 update for python-jwcrypto

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper handling of highly compressed data (CVE-ID: CVE-2026-39373)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in the deserialize function when processing crafted JWE tokens with ZIP compression. A remote attacker can send a specially crafted JWE token to cause a denial of service.

Memory-constrained systems are more likely to be affected.

2) Resource exhaustion (CVE-ID: CVE-2024-28102)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing highly compressed data within the deserialize() function. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1926