CVE catalog
CVE-2024-33663
python-jose: CVE-2024-33663
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.31% · Oct 25, 2026
python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-jose | bookworm | 3.3.0+dfsg-4 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.7 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.8 | vulnerable |
| PyPI | python-jose | Not reported | 0.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.7.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.1 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.2 | vulnerable |
| PyPI | python-jose | Not reported | 1.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.2 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 3.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.5.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.7 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.8 | vulnerable |
| PyPI | python-jose | Not reported | 0.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.7.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.1 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.2 | vulnerable |
| PyPI | python-jose | Not reported | 1.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.2 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 3.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.4.0 | fixed |
| PyPI | python-jose | Not reported | 0.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.7 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.8 | vulnerable |
| PyPI | python-jose | Not reported | 0.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.7.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.1 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.2 | vulnerable |
| PyPI | python-jose | Not reported | 1.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.2 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 3.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.4.0 | fixed |
| PyPI | python-jose | Not reported | 0.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.7 | vulnerable |
| PyPI | python-jose | Not reported | 0.1.8 | vulnerable |
| PyPI | python-jose | Not reported | 0.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.0 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.3 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.4 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.5 | vulnerable |
| PyPI | python-jose | Not reported | 0.5.6 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.1 | vulnerable |
| PyPI | python-jose | Not reported | 0.6.2 | vulnerable |
| PyPI | python-jose | Not reported | 0.7.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.1 | vulnerable |
| PyPI | python-jose | Not reported | 1.3.2 | vulnerable |
| PyPI | python-jose | Not reported | 1.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 2.0.2 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.0.1 | vulnerable |
| PyPI | python-jose | Not reported | 3.1.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.2.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.3.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.4.0 | vulnerable |
| PyPI | python-jose | Not reported | 3.5.0 | vulnerable |
| Suse | python-python-jose | package hub 15 sp5 | 3.0.1-bp155.3.3.1 | fixed |
| Opensuse | python-python-jose | leap 15.5 | 3.0.1-bp155.3.3.1 | fixed |
| Opensuse | python-cryptography | tumbleweed | 3.3.0-3.1 | fixed |
| Ubuntu | python-jose | 22.04 | 3.3.0+dfsg-1 | vulnerable |
| Ubuntu | python-jose | 24.04 | 3.3.0+dfsg-4 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-jose | source | bookworm | (unfixed) | not yet assigned | Not reported | [1070375] |
| PyPI | python-jose | PyPI | Not reported | 3.4.0 | Not reported | GHSA-6C5P-J8VQ-PQHJ | Not reported |
| PyPI | python-jose | PyPI | Not reported | 3.4.0 | Not reported | PYSEC-2024-232 | Not reported |
| Suse | python-python-jose | rpm | package hub 15 sp5 | 3.0.1-bp155.3.3.1 | Not reported | OPENSUSE-SU-2024:0118-1 | Not reported |
| Opensuse | python-python-jose | rpm | leap 15.5 | 3.0.1-bp155.3.3.1 | Not reported | OPENSUSE-SU-2024:0118-1 | Not reported |
| Opensuse | python-cryptography | rpm | tumbleweed | 3.3.0-3.1 | Not reported | OPENSUSE-SU-2024:13928-1 | Not reported |
Notes
[bookworm] python-jose: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://access.redhat.com/errata/RHSA-2024:6428]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_0118-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-33663]
- [https://osv.dev/vulnerability/PYSEC-2026-4298]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-33663]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:0118-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13928-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-33663]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]