CVE-2013-4346
2 advisories.
PyPI/oauth2 CVE-2013-4346: high 7.5, EPSS 2.43%
SimpleGeo python-oauth2 does not check the nonce allowing replay attacks
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.9rc1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-4433-4cxq-vv73
- https://nvd.nist.gov/vuln/detail/CVE-2013-4346
- https://github.com/simplegeo/python-oauth2/issues/129
- https://access.redhat.com/errata/RHSA-2015:1591
- https://access.redhat.com/errata/RHSA-2015:1592
- https://access.redhat.com/security/cve/CVE-2013-4346
- https://bugzilla.redhat.com/show_bug.cgi?id=1007746
- https://github.com/joestump/python-oauth2
- https://github.com/pypa/advisory-database/tree/main/vulns/oauth2/PYSEC-2014-85.yaml
- https://web.archive.org/web/20200228063302/http://www.securityfocus.com/bid/62386
- http://www.openwall.com/lists/oss-security/2013/09/12/7
CVE-2013-4346 · published · modified · JSON
PyPI/oauth2 CVE-2013-4346: unknown, EPSS 2.43%
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.
Action: Upgrade oauth2 to 1.9rc1 or later.
pip install oauth2==1.9rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.9rc1 | - |
Fixed versions
| 1.9rc1 |
Sources
- osv: PYSEC-2014-85
- http://www.openwall.com/lists/oss-security/2013/09/12/7
- https://github.com/simplegeo/python-oauth2/issues/129
- http://www.securityfocus.com/bid/62386
- https://github.com/advisories/GHSA-4433-4cxq-vv73
CVE-2013-4346 · published · modified · JSON