Comments (8)
benknoble
commented on June 5, 2024
Agreed; other reports list 3.2.1 as still affected, even though the NIST report does not.
from oauthlib.
jacwalte
commented on June 5, 2024
Still seeing this issue. Are there any updates?
from oauthlib.
auvipy
commented on June 5, 2024
git log shows 2e40b41 was merged
from oauthlib.
auvipy
commented on June 5, 2024
release notes https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1
from oauthlib.
noren95
commented on June 5, 2024
Apparently, it was merged but into 'master' only.
The vulnerable line still exists on v3.2.1:
https://github.com/oauthlib/oauthlib/blob/v3.2.1/oauthlib/uri_validate.py#L69
from oauthlib.
auvipy
commented on June 5, 2024
@JonathanHuot can you chime in please?
from oauthlib.
JonathanHuot
commented on June 5, 2024
I have released 3.2.2 with patched file. I've tried to update CVE from within github, but it seems not reflecting the info anywhere. I will look into creating a new one if required later.
Thanks for the report! It was a mistake during previous release preparation.
from oauthlib.
noren95
commented on June 5, 2024
Hi @JonathanHuot
Thank you for the updates!
from oauthlib.
Related Issues (20)
- oauth2 implicit grant does not seem to properly return the error in uri fragment when client is unauthorized to use response_type token HOT 1
- RFC5849 oauth1 signature base_string_uri doesn't parse IPv6 addresses
- Pre-configured OIDC server should use OIDC refresh token grant type HOT 5
- Security Issue in OAuthLib HOT 1
- CI/Pipeline broken since TravisCI consumed all "OSS credits" HOT 2
- URI validation does not support shortform localhost IPv6 URIs HOT 1
- Latest version on pypi.org (3.2.2) not reflected here - is it safe? HOT 2
- private_key_jwt
- Will the default warning behavior for scope changes be updated? HOT 1
- Please support http.client as the a request client HOT 3
- OAuth2Session is not pickleable HOT 2
- Docs: Add link to GitHub project sidebar? HOT 1
- Support for refresh token expiration
- typing issues HOT 2
- Problem with use oauthlib with last version cryptography
- Adopt `build` because running `setup.py` is deprecated for security reasons
- Oauthlib not catching error: CompactToken validation failed with reason code: 80049228 HOT 1
- accessing session user in validate_silent_login
- fastapi Support HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oauthlib.