PT-2020-16372 · Python · Python Oic

Christian Mainka + 1 · Published 2020-12-02 · Updated 2024-07-12 · CVE-2020-26244

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python oic versions prior to 1.2.1

Description The issue affects client implementations using the Python oic library, a Python OpenID Connect implementation. There are several related cryptographic issues:

1. The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
2. JWA none algorithm was allowed in all flows.
3. oic.consumer.Consumer.parse authz returns an unverified IdToken, with verification left to the implementator's discretion.
4. The iat claim was not checked for sanity, allowing it to be in the future.

Recommendations For versions prior to 1.2.1, update to version 1.2.1 to resolve the issues. As a temporary workaround, consider disabling the use of the JWA none algorithm in all flows until the update is applied. Restrict access to the oic.consumer.Consumer.parse authz function to minimize the risk of exploitation until the update is applied. Avoid using the iat claim without proper sanity checks until the update is applied.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-325

CWE-347

Related Identifiers

CVE-2020-26244

GHSA-4FJV-PMHG-3RFG

OPENSUSE-SU-2024:11244-1

OPENSUSE-SU-2024:14150-1

PYSEC-2020-69

Affected Products

Python Oic

References · 15

• https://github.com/OpenIDC/pyoidc/commit/62f8d753fa17c8b1f29f8be639cf0b33afb02498 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26244 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-69 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4fjv-pmhg-3rfg · Vendor Advisory
• https://pypi.org/project/oic · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26244 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14150-1 · Vendor Advisory
• https://github.com/OpenIDC/pyoidc/security/advisories/GHSA-4fjv-pmhg-3rfg · Note
• https://github.com/OpenIDC/pyoidc/releases/tag/1.2.1 · Note
• https://github.com/OpenIDC/pyoidc · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/oic/PYSEC-2020-69.yaml · Note
• https://suse.com/security/cve/CVE-2020-26244 · Note
• https://t.me/cvenotify/6494 · Telegram Post
• https://t.me/cvenotify/6484 · Telegram Post
• https://t.me/cibsecurity/17056 · Telegram Post