Описание
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/jammy | released | 0.15.5-1ubuntu0.1~esm2 |
| esm-apps/noble | released | 1.3.0-1ubuntu0.1~esm2 |
| esm-apps/resolute | released | 1.6.7-1ubuntu0.1~esm1 |
| jammy | needed | |
| noble | needed | |
| questing | ignored | end of life, was needs-triage |
| resolute | needed | |
| upstream | released | 1.6.9-1 |
Показывать по
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.
Authlib is a Python library which builds OAuth and OpenID Connect serv ...
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Уязвимость реализации JOSE библиотеки Authlib для серверов OAuth и OpenID Connect, связанная с раскрытием информации через несоответствие, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
6.5 Medium
CVSS3