CVE-2020-26244: Python oic Cryptographic Issues
Summary
CVE-2020-26244: Python oic is a Python OpenID Connect implementation. Affects oic across 2 version ranges.
< 1.2.1
< 62f8d753fa17c8b1f29f8be639cf0b33afb02498
Fixed in 62f8d753fa17c8b1f29f8be639cf0b33afb02498. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python oic is a Python OpenID Connect implementation. It provides functionality for client implementations that use the library. The package is available on PyPI and the source code is hosted on GitHub. The vulnerability affects versions before 1.2.1 of the package.
Vulnerability Detail
The vulnerability in Python oic before version 1.2.1 is related to several cryptographic issues affecting client implementations. These issues include:
-
The IdToken signature algorithm was not checked automatically, potentially allowing for the use of weak algorithms.
-
The JWA
nonealgorithm was allowed in all flows, which could lead to insecure authentication. -
The
oic.consumer.Consumer.parse_authzmethod returned an unverified IdToken, leaving the verification to the implementator's discretion. -
The
iatclaim (issued at) was not checked for sanity, allowing for future timestamps.
These issues have been patched in version 1.2.1 of the package.
How To Fix
Minimum fixed version
62f8d753fa17c8b1f29f8be639cf0b33afb02498
This is the first release that contains the fix.
pip install --upgrade "oic==62f8d753fa17c8b1f29f8be639cf0b33afb02498"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Python oic package before version 1.2.1 is vulnerable to several cryptographic issues. Users should upgrade to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for oic →
FAQ
Python oic is a Python OpenID Connect implementation that provides functionality for client implementations.
Versions before 1.2.1 of Python oic are affected by this vulnerability.
The vulnerability could lead to insecure authentication and compromise the security of client implementations using Python oic.
To fix the vulnerability, upgrade to version 1.2.1 or later of Python oic.
For more information, you can refer to the official advisory database for Python oic (PYSEC-2020-69).
