What is GHSA-w799-prg3-cx77?

GHSA-w799-prg3-cx77 is a security advisory published by GitHub Security Advisories with Critical severity. python-jose failure to use a constant time comparison for HMAC keys

Which CVE IDs does GHSA-w799-prg3-cx77 cover?

GHSA-w799-prg3-cx77 covers the following CVE IDs: CVE-2016-7036. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w799-prg3-cx77?

GHSA-w799-prg3-cx77 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-w799-prg3-cx77?

GHSA-w799-prg3-cx77 affects 1 product, including: pip/python-jose:\u003c 1.3.2.

GHSA-w799-prg3-cx77CriticalCVSS 9.8

python-jose failure to use a constant time comparison for HMAC keys

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 16, 2024

🔗 CVE IDs covered (1)

CVE-2016-7036 →

📋 Description

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.

🎯 Affected products1

pip/python-jose:< 1.3.2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2016-7036
https://github.com/mpdavis/python-jose/releases/tag/1.3.2
https://web.archive.org/web/20210123221523/http://www.securityfocus.com/bid/95845
https://github.com/mpdavis/python-jose/commit/73007d6887a7517ac07c6e755e494baee49ef513
https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93
https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2017-28.yaml
https://github.com/advisories/GHSA-w799-prg3-cx77