CVE-2016-7036

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-361

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/95845
https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93Issue Tracking, Patch, Third Party Advisory
https://github.com/mpdavis/python-jose/releases/tag/1.3.2Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95845
https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93Issue Tracking, Patch, Third Party Advisory
https://github.com/mpdavis/python-jose/releases/tag/1.3.2Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70377.5The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, wh CVE-2016-70387.3In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.CVE-2016-70397.5The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibl CVE-2016-70408.8Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and t CVE-2016-70416.5Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory CVE-2016-70426.2The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protecto CVE-2016-70439.8It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java proper CVE-2016-70447.5The unformat_24bit_color function in the format parsing code in Irssi before 0.8.20, when compiled with true-color enabled, allows remote at CVE-2016-70457.5The format_send_to_gui function in the format parsing code in Irssi before 0.8.20 allows remote attackers to cause a denial of service (heap CVE-2016-70465.9Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers CVE-2016-70474.3A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability w CVE-2016-70488.1The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute a