CVE-2013-4346: SimpleGeo python-oauth2 does not check the nonce allowing replay attacks
(updated )
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL. The vulnerability does not appear to be patched according to the following discussion.
References
- access.redhat.com/errata/RHSA-2015:1591
- access.redhat.com/errata/RHSA-2015:1592
- access.redhat.com/security/cve/CVE-2013-4346
- bugzilla.redhat.com/show_bug.cgi?id=1007746
- github.com/advisories/GHSA-4433-4cxq-vv73
- github.com/joestump/python-oauth2
- github.com/pypa/advisory-database/tree/main/vulns/oauth2/PYSEC-2014-85.yaml
- github.com/simplegeo/python-oauth2/issues/129
- nvd.nist.gov/vuln/detail/CVE-2013-4346
- web.archive.org/web/20200228063302/http://www.securityfocus.com/bid/62386
Code Behaviors & Features
Detect and mitigate CVE-2013-4346 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →