Bug 1007758 (CVE-2013-4347)

Summary:	CVE-2013-4347 python-oauth2: Uses poor PRNG in nonce
Product:	[Other] Security Response	Reporter:	Ratul Gupta <ratulg>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bdunne, bkearney, carnil, cpelland, gmollett, jfrey, jmatthew, jrafanie, jrusnack, katello-bugs, kseifried, metherid, mmccune, obarenbo, pj.pandit, tcallawa, tjay, tsanders, xlecauch
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that python-oauth2 did not properly generate random values for use in nonces. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-12 21:55:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1007766, 1007767, 1121874
Bug Blocks:	1007764, 1145400

Description Ratul Gupta 2013-09-13 09:26:39 UTC

It was found that in python-oauth2, an application for authorizing flows for web application,  the nonce value generated isn't random enough, because while doing bulk operations, nonce might get repeated, so there is a chance of predictability. This could allow MITM attackers to conduct replay attacks.

References:
http://www.openwall.com/lists/oss-security/2013/09/12/7
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722657
https://github.com/simplegeo/python-oauth2/issues/9

Comment 1 Ratul Gupta 2013-09-13 09:39:14 UTC

Created python-oauth2 tracking bugs for this issue:

Affects: fedora-all [bug 1007766]
Affects: epel-6 [bug 1007767]

Comment 4 Kurt Seifried 2014-07-22 07:30:20 UTC

CloudForms Management Engine no longer includes python-oauth2, so removing.

Comment 5 Fedora Update System 2014-09-26 09:04:35 UTC

python-oauth2-1.5.211-7.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-09-26 09:06:29 UTC

python-oauth2-1.5.211-7.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-09-27 09:51:19 UTC

python-oauth2-1.5.211-7.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2014-10-28 06:43:50 UTC

python-oauth2-1.5.211-8.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-10-28 06:46:08 UTC

python-oauth2-1.5.211-8.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-10-28 10:57:38 UTC

python-oauth2-1.5.211-8.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-10-28 11:04:12 UTC

python-oauth2-1.5.211-8.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2014-11-01 16:22:13 UTC

python-oauth2-1.5.211-8.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 errata-xmlrpc 2015-08-12 04:51:52 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:1591 https://access.redhat.com/errata/RHSA-2015:1591

Comment 15 errata-xmlrpc 2015-08-12 05:07:29 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:1592 https://access.redhat.com/errata/RHSA-2015:1592