Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

oic

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6PyPIAmendedPublished

    Multiple cryptographic issues in Python oic

    CVE-2020-26244 · GHSA-4fjv-pmhg-3rfg

    Affected
    • PyPI oic < 1.2.1
    Fixed in
    1.2.1· Vendor fix available
    Issue
    Impact Client implementations using this library Issues 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA none algorithm was allowed in all flows. 3) oic.consumer.Consumer.parseauthz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future) Patches 1) IdToken signature is now always checked. 2) JWA none algorithm is now allowed only if using the responsetype code 3) IdToken verification is now done automatically. 4) iat claim is now checked for sanity.

    Recommended action: Upgrade to 1.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →