mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-09 14:24:21 +00:00
Code Issues Projects Releases Wiki Activity

python3-oauthlib: patch CVE-2026-49265

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49265

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
This commit is contained in:
Ankur Tyagi committed 2026-10-26 23:15:53 +13:00
1 parent 1ea3019791
commit d3e07213ff
2 files changed
+53
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-python/recipes-devtools/python/python3-oauthlib/CVE-2026-49265.patch
+51
View File
@@ -0,0 +1,51 @@
From f3510969587daff0de06a233cf6be3a6233b3429 Mon Sep 17 00:00:00 2001
From: Jonathan Huot <jonathan.huot@gmail.com>
Date: Sat, 11 Jul 2026 13:15:29 +0200
Subject: [PATCH] Improve PKCE code comparison
(cherry picked from commit 74664d3fe037a354e180e305135c6bab1747a6b0)
CVE: CVE-2026-49265
Upstream-Status: Backport [https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0]
Dropped changes to the CHANGELOG file.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
oauthlib/oauth2/rfc6749/grant_types/authorization_code.py | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
index 09dc619..c73314a 100644
--- a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
+++ b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
@@ -4,6 +4,7 @@ oauthlib.oauth2.rfc6749.grant_types
"""
import base64
import hashlib
+import hmac
import json
import logging
@@ -44,9 +45,10 @@ def code_challenge_method_s256(verifier, challenge):
.. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
"""
- return base64.urlsafe_b64encode(
+ expected = base64.urlsafe_b64encode(
hashlib.sha256(verifier.encode()).digest()
- ).decode().rstrip('=') == challenge
+ ).decode().rstrip('=')
+ return hmac.compare_digest(expected, challenge)
def code_challenge_method_plain(verifier, challenge):
@@ -58,7 +60,7 @@ def code_challenge_method_plain(verifier, challenge):
.. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
"""
- return verifier == challenge
+ return hmac.compare_digest(verifier, challenge)
class AuthorizationCodeGrant(GrantTypeBase):