-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the lack of validation on the 'p2c' parameter in PBES2 key derivation. The patch adds a check against 'default_max_pbkdf2_iterations' in PBES2._get_key, confirming this was the vulnerable point. The tests added in jwcrypto/tests.py explicitly validate this boundary by triggering an error when p2c exceeds the maximum, reinforcing that this function was the attack surface.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jwcrypto | pip | < 1.5.1 | 1.5.1 |