GitHub Advisoryadvisory · PyPI

GHSA-4433-4cxq-vv73 SimpleGeo python-oauth2 does not check the nonce allowing replay attacks

HIGH Published 2022-05-17 Modified 2024-10-07 Official page ↗
Aliases
CVE-2013-4346
Ecosystem
PyPI
Packages
oauth2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-347
Reviewed
2024-02-23

Affected packages

• PyPI oauth2: <= 1.9rc1 (no fix yet)

Description

The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL. The vulnerability does not appear to be patched according to the following discussion.

Related

Alias · CVE (1)

  • CVE-2013-4346 The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References