CVE-2013-4347 SimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces
MediumCVSS 5.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi oauth2(PyPI) | < 1.9rc1 | 1.9rc1 |
| pypi oauth2(PyPI) | = 1.0.0 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.4 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.5 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.6 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.7 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.8 | No fix listed |
| pypi oauth2(PyPI) | = 1.0.9 | No fix listed |
| pypi oauth2(PyPI) | = 1.1.0 | No fix listed |
| pypi oauth2(PyPI) | = 1.1.1 | No fix listed |
| pypi oauth2(PyPI) | = 1.1.3 | No fix listed |
| pypi oauth2(PyPI) | = 1.2.0 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.150 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.153 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.155 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.158 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.159 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.160 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.161 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.162 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.163 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.164 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.165 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.166 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.167 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi oauth2(PyPI) | = 1.5.168 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.169 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.170 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.210 | No fix listed |
| pypi oauth2(PyPI) | = 1.5.211 | No fix listed |
| urbanairship python-oauth2 | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking
- github.com patch
- github.com patch
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- github.com product
- github.com
- [oss-security] 20130912 Re: cve requests for python-oauth2 mailing-list
- 62388 vdb-entry
- github.com vendor-advisory