datawire-cloudtools (0.2.6) potentially affected by CVE-2016-7036 via python-jose (0.5.5)

python-jose PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - datawire-cloudtools 0.2.6 Source cves: CVE-2016-7036 Source advisory: OSV:GHSA-W799-PRG3-CX77...

CVE-2016-7036

CVE-2016-7036 affects the Python package python-jose before version 1.3.2 . The vulnerability arises from not using a constant-time comparison when validating HMAC keys, allowing an attacker to induce an unspecified impact. Public sources in the connected set confirm the issue and point to a fix ...