CVE-2016-7036

CVE-2016-7036 affects the Python package python-jose before version 1.3.2 . The vulnerability arises from not using a constant-time comparison when validating HMAC keys, allowing an attacker to induce an unspecified impact. Public sources in the connected set confirm the issue and point to a fix ...