PT-2017-9074 · Python · Python-Jose

Michael Davis · Publicado 2017-01-23 · Atualizado 2022-05-17 · CVE-2016-7036

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions python-jose versions prior to 1.3.2

Description The issue allows attackers to have an unspecified impact by leveraging the failure to use a constant time comparison for HMAC keys.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-361

CWE-208

Identificadores relacionados

CVE-2016-7036

GHSA-W799-PRG3-CX77

PYSEC-2017-28

Produtos afetados

Python-Jose

Referências · 11

• https://github.com/mpdavis/python-jose/releases/tag/1.3.2 · Correção
• https://github.com/mpdavis/python-jose/commit/73007d6887a7517ac07c6e755e494baee49ef513 · Nota
• https://github.com/mpdavis/python-jose · Nota
• https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2017-28.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7036 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w799-prg3-cx77 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-7036 · Aviso do Fabricante
• http://securityfocus.com/bid/95845 · Nota
• https://web.archive.org/web/20210123221523/http://securityfocus.com/bid/95845 · Nota
• https://osv.dev/vulnerability/PYSEC-2017-28 · Aviso do Fabricante