Back

HIGH

python-oauth2: _check_signature() ignores the nonce value when validating signed urls

Published May 20, 2014

Description

The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (2)

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published May 20, 2014
Updated Aug 6, 2024
Reserved Jun 12, 2013
NVD
Status Modified
Modified Jun 16, 2026
Red Hat
Severity Moderate
Public date Feb 4, 2013
GHSA-4433-4CXQ-VV73