PyPI/oauth2 CVE-2013-4346: unknown, EPSS 2.43%

The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.

Action: Upgrade oauth2 to 1.9rc1 or later.

pip install oauth2==1.9rc1

Affected

Fixed versions

Sources

• osv: PYSEC-2014-85
• http://www.openwall.com/lists/oss-security/2013/09/12/7
• https://github.com/simplegeo/python-oauth2/issues/129
• http://www.securityfocus.com/bid/62386
• https://github.com/advisories/GHSA-4433-4cxq-vv73

CVE-2013-4346 · published 2014-05-20T14:55:00Z · modified 2026-06-10T17:02:26.300609843Z · JSON