{"action":"Upgrade jwcrypto to 1.5.1 or later.","affected":[{"fixed":"1.5.1","introduced":"0"}],"component":"jwcrypto","cve_ids":["CVE-2023-6681"],"ecosystem":"PyPI","epss":0.00884,"exploited":false,"fixed_versions":["1.5.1"],"ghsa_id":"GHSA-cw2r-4p82-qv79","id":"tcs_01M5KFDVPPYDF2CBJGZ8P64GEQ","modified_at":"2024-11-12T19:15:29.552255Z","published_at":"2023-12-28T16:36:59Z","references":["https://osv.dev/vulnerability/GHSA-cw2r-4p82-qv79","https://github.com/latchset/jwcrypto/security/advisories/GHSA-cw2r-4p82-qv79","https://nvd.nist.gov/vuln/detail/CVE-2023-6681","https://github.com/latchset/jwcrypto/commit/d2655d370586cb830e49acfb450f87598da60be8","https://access.redhat.com/errata/RHSA-2024:3267","https://access.redhat.com/errata/RHSA-2024:9281","https://access.redhat.com/security/cve/CVE-2023-6681","https://bugzilla.redhat.com/show_bug.cgi?id=2260843","https://github.com/latchset/jwcrypto","https://github.com/pypa/advisory-database/tree/main/vulns/jwcrypto/PYSEC-2024-104.yaml"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-cw2r-4p82-qv79","url":"https://osv.dev/vulnerability/GHSA-cw2r-4p82-qv79"}],"summary":"DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value"}