CVE-2020-26244 Cryptographic issues in Python oic

2020-12-0220:05:15

CWE-347

CWE-325

GitHub_M

www.cve.org

python oic

cryptographic issues

client implementations

cve-2020-26244

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.002

Percentile

52.0%

JSON

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.

CNA Affected

[
  {
    "product": "pyoidc",
    "vendor": "OpenIDC",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.2.1"
      }
    ]
  }
]