7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-33663

CVE-2024-33663: python-jose algorithm confusion with OpenSSH ECDSA keys

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-33663

CVE-2024-33663:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
python-jose	pip	< 3.4.0	3.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2024-33663) in python-jose < 3.4.0 is an algorithm confusion issue. It occurs when jose.jwt.decode is called without an explicit algorithms parameter. This allows an attacker to use an asymmetric public key (like an OpenSSH ECDSA key) as a secret for an HMAC symmetric algorithm (e.g., HS256) if the token's header specifies such an algorithm. The root cause was an insufficient blacklist (invalid_strings) in the __init__ methods of jose.backends.cryptography_backend.CryptographyHMACKey and jose.backends.native.NativeHMACKey. This blacklist failed to identify all types of public keys, allowing them to be misused as HMAC secrets. The fix, introduced in commit 12f30c8c87b343ad4f9e27e8b5b9e0ef7d665cb3, replaced this blacklist with more robust checks using new utility functions is_pem_format and is_ssh_key.

The primary user-facing function involved is jose.jwt.decode. During exploitation, this function would call into the vulnerable __init__ methods of the backend HMACKey classes, which contained the flawed validation logic. Therefore, these three functions would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.