{"action":"Upgrade python-jose to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"}],"component":"python-jose","cve_ids":["CVE-2016-7036"],"ecosystem":"PyPI","epss":0.02171,"exploited":false,"fixed_versions":["1.3.2"],"ghsa_id":"GHSA-w799-prg3-cx77","id":"tcs_01M5KG76ZP32E5YXNAY2HQNGXM","modified_at":"2026-06-10T17:02:30.329181144Z","published_at":"2017-01-23T21:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-28","https://github.com/mpdavis/python-jose/releases/tag/1.3.2","https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93","http://www.securityfocus.com/bid/95845","https://github.com/advisories/GHSA-w799-prg3-cx77"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-28","url":"https://osv.dev/vulnerability/PYSEC-2017-28"}],"summary":"python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys."}