GitHub Advisoryadvisory · PyPI

GHSA-rv8h-p43r-4x5r SimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces

MEDIUM Published 2022-05-17 Modified 2024-10-07 Official page ↗
Aliases
CVE-2013-4347
Ecosystem
PyPI
Packages
oauth2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-330
Reviewed
2023-08-29

Affected packages

• PyPI oauth2: < 1.9rc1 → fixed in 1.9rc1

Description

The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.

Related

Alias · CVE (1)

  • CVE-2013-4347 The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate… vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References