discourse-sso-oidc-bridge-consideratio (>=0.2.0 <=0.2.1), flask-pyoidc (>=3.1.0 <=3.6.0) +3 more potentially affected by CVE-2020-26244 via oic (>=0.8.2 <=1.1.2)

oic PYPI version =0.8.2, =0.2.0, =3.1.0, =0.0.9, =2.0.0, =0.6.1, =3.4.8 Source cves: CVE-2020-26244 Source advisory: OSV:GHSA-4FJV-PMHG-3RFG...

CVE-2020-26244

CVE-2020-26244 affects Python oic (OpenID Connect) before version 1.2.1. The issues include: IdToken signature algorithm not always checked, JWA none allowed in all flows, oic.consumer.Consumer.parse_authz returning an unverified IdToken, and iat not checked for sanity. A fix is released in versi...

CVE-2020-26244 Cryptographic issues in Python oic

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1 The IdToken signature algorithm was not checked automatically, but only if the expected...