Lucene search
Veracode Vulnerability DatabaseVERACODE:3324HistoryJan 24, 2017 - 2:22 a.m.
Timing Attack Via Authentication
2017-01-2402:22:04
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
5
0.003 Low
EPSS
Percentile
70.5%
python-jose is vulnerable to timing attacks. The vulnerability is possible because it has a flaw in verification function which allows a constant time comparison for HMAC keys.
| CPE | Name | Operator | Version |
|---|---|---|---|
| python-jose | eq | 0.7.0 | |
| python-jose | le | 1.3.1 |
Related
osv
osv
PYSEC-2017-28
2017-01-23 21:59:00
python-jose failure to use a constant time comparison for HMAC keys
2022-05-17 03:02:29
CVE-2016-7036
2017-01-23 21:59:02
debiancve
debiancve
CVE-2016-7036
2017-01-23 21:59:02
github
github
python-jose failure to use a constant time comparison for HMAC keys
2022-05-17 03:02:29
cvelist
cvelist
CVE-2016-7036
2017-01-23 21:00:00
cve
cve
CVE-2016-7036
2017-01-23 21:59:02
nvd
nvd
CVE-2016-7036
2017-01-23 21:59:02
prion
prion
Code injection
2017-01-23 21:59:00