PT-2017-9074 · Python · Python-Jose

Michael Davis · Published 2017-01-23 · Updated 2022-05-17 · CVE-2016-7036

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions python-jose versions prior to 1.3.2

Description The issue allows attackers to have an unspecified impact by leveraging the failure to use a constant time comparison for HMAC keys.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-361

CWE-208

Related Identifiers

CVE-2016-7036

GHSA-W799-PRG3-CX77

PYSEC-2017-28

Affected Products

Python-Jose

References · 11

• https://github.com/mpdavis/python-jose/releases/tag/1.3.2 · Patch
• https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-7036 · Security Note
• https://osv.dev/vulnerability/GHSA-w799-prg3-cx77 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7036 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-28 · Vendor Advisory
• https://github.com/mpdavis/python-jose/commit/73007d6887a7517ac07c6e755e494baee49ef513 · Note
• https://github.com/mpdavis/python-jose · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2017-28.yaml · Note
• http://securityfocus.com/bid/95845 · Note
• https://web.archive.org/web/20210123221523/http://securityfocus.com/bid/95845 · Note