CVE-2013-4346 SimpleGeo python-oauth2 does not check the nonce allowing replay attacks
MediumCVSS 4.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi oauth2(PyPI) | <= 1.9rc1 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.0 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.4 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.5 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.6 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.7 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.8 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.9 | No fix listed |
| pypi oauth2(PyPI) | = 1.1.0 | No fix listed |
| pypi oauth2(PyPI) | = 1.1.1 | No fix listed |
| pypi oauth2(PyPI) | = 1.1.3 | No fix listed |
| pypi oauth2(PyPI) | = 1.2.0 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.150 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.153 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.155 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.158 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.159 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.160 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.161 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.162 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.163 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.164 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.165 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.166 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.167 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi oauth2(PyPI) | = 1.5.168 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.169 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.170 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.210 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.211 | No fix listed |
| pypi oauth2(PyPI) | = 1.9rc1 | No fix listed |
| pypi oauth2(PyPI) | < 1.9rc1 | 1.9rc1 |
| urbanairship python-oauth2 | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- github.com product
- github.com
- web.archive.org
- [oss-security] 20130912 Re: cve requests for python-oauth2 mailing-list
- 62386 vdb-entry
- github.com vendor-advisory