CVE-2016-7036

Critical

Published: 23/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Versions of python-jose before 1.3.2 do not use constant time comparison for HMAC keys, which can be leveraged by attackers in unspecified ways.

The lack of constant time comparison for HMAC keys may lead to information disclosure about the keys, increasing the risk of data integrity attacks.

It is recommended to upgrade to python-jose version 1.3.2 or later to mitigate this vulnerability.

Original NVD description (English source)

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.