datawire-cloudtools (0.2.6) potentially affected by CVE-2016-7036 via python-jose (0.5.5)

python-jose PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - datawire-cloudtools 0.2.6 Source cves: CVE-2016-7036 Source advisory: MEND:CVE-2016-7036...

CVE-2016-7036: Undefined Security Weakness

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys...

PT-2017-9074

Name of the Vulnerable Software and Affected Versions python-jose versions prior to 1.3.2 Description The issue allows attackers to have an unspecified impact by leveraging the failure to use a constant time comparison for HMAC keys. Recommendations For versions prior to 1.3.2, update to version...