CVE-2013-4347

Published: May 20, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.

Affected (1)

Products: Urbanairship: Python Oauth2

Urbanairship

1 product

Python Oauth2

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Urbanairship Python Oauth2	All versions

Related CWEs

CWE-310

References (8)

http://www.openwall.com/lists/oss-security/2013/09/12/7

Source: secalert@redhat.com

http://www.securityfocus.com/bid/62388

Source: secalert@redhat.com

https://github.com/simplegeo/python-oauth2/issues/9

Source: secalert@redhat.com

https://github.com/simplegeo/python-oauth2/pull/146

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2013/09/12/7

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/62388

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/simplegeo/python-oauth2/issues/9

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/simplegeo/python-oauth2/pull/146

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.