via oss-sec

CVE-2013-4347

http://comments.gmane.org/gmane.comp.security.oss.general/11105

Hello Kurt, all, I recently gave python-oauth2 a quick audit and believe
it needs three CVE entries:

- _check_signature() ignores the nonce value when validating signed urls

    def _check_signature(self, request, consumer, token):
        timestamp, nonce = request._get_timestamp_nonce()
        self._check_timestamp(timestamp)
        signature_method = self._get_signature_method(request)

        try:
            signature = request.get_parameter('oauth_signature')
        except:
            raise MissingSignature('Missing oauth_signature.')

        # Validate the signature.
        valid = signature_method.check(request, consumer, token, signature)

        if not valid:
            key, base = signature_method.signing_base(request, consumer, token)

            raise Error('Invalid signature. Expected signature base '
                'string: %s' % base)

Ignoring the nonce value enables replay attacks.

This appears to already be known (ignoring the misleading title):
https://github.com/simplegeo/python-oauth2/issues/129

- _check_timestamp() does not constrain how far into the future times may be,
....