GitHub Advisory DatabaseGHSA-RV8H-P43R-4X5RSimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
66.0%
The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.
Affected configurations
References
www.openwall.com/lists/oss-security/2013/09/12/7
www.securityfocus.com/bid/62388
access.redhat.com/errata/RHSA-2015:1591
access.redhat.com/errata/RHSA-2015:1592
access.redhat.com/security/cve/CVE-2013-4347
bugzilla.redhat.com/show_bug.cgi?id=1007758
github.com/advisories/GHSA-rv8h-p43r-4x5r
github.com/joestump/python-oauth2/commit/82dd2cdd4954cd7b8983d5d64c0dfd9072bf4650
github.com/simplegeo/python-oauth2/issues/9
github.com/simplegeo/python-oauth2/pull/146
nvd.nist.gov/vuln/detail/CVE-2013-4347
Related
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
66.0%