CVE-2013-4346

Advisory

Oauth2 is vulnerable to CVE-2013-4346: It was found that python-oauth2 did not properly verify the nonce of a signed URL. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website.
https://github.com/joestump/python-oauth2/issues/129

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.


MLIST:[oss-security] 20130912 Re: cve requests for python-oauth2: http://www.openwall.com/lists/oss-security/2013/09/12/7
MISC:https://github.com/simplegeo/python-oauth2/issues/129: https://github.com/simplegeo/python-oauth2/issues/129
BID:62386: http://www.securityfocus.com/bid/62386

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4346
• http://www.openwall.com/lists/oss-security/2013/09/12/7
• https://github.com/simplegeo/python-oauth2/issues/129
• http://www.securityfocus.com/bid/62386