Vulnerability in Openidc Pyoidc
CVE-2020-26244
Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.008 (55.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Openidc Pyoidc — versions < 1.2.1
- Python Openid Connect Project
Weakness classification (CWE)
References
- github.com/OpenIDC/pyoidc/security/advisories/GHSA-4fjv-pmhg-3rfg (Third Party Advisory)
- pypi.org/project/oic/ (Product, Vendor Advisory)
- github.com/OpenIDC/pyoidc/commit/62f8d753fa17c8b1f29f8be639cf0b33afb02498 (Patch, Third Party Advisory)
- github.com/OpenIDC/pyoidc/releases/tag/1.2.1 (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-26244?
- CVE-2020-26244 is a medium-severity vulnerability in Openidc Pyoidc, classified under Missing Cryptographic Step. CVSS score: 6.8/10. Published 2020-12-02.
- How severe is CVE-2020-26244?
- Medium severity. CVSS v3 base score is 6.8 out of 10.