mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-09 02:14:23 +00:00
Ankur Tyagi
d3e07213ff
Details: https://nvd.nist.gov/vuln/detail/cve-2026-49265 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
52 lines
1.8 KiB
Diff
52 lines
1.8 KiB
Diff
From f3510969587daff0de06a233cf6be3a6233b3429 Mon Sep 17 00:00:00 2001
|
|
From: Jonathan Huot <jonathan.huot@gmail.com>
|
|
Date: Sat, 11 Jul 2026 13:15:29 +0200
|
|
Subject: [PATCH] Improve PKCE code comparison
|
|
|
|
(cherry picked from commit 74664d3fe037a354e180e305135c6bab1747a6b0)
|
|
|
|
CVE: CVE-2026-49265
|
|
Upstream-Status: Backport [https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0]
|
|
|
|
Dropped changes to the CHANGELOG file.
|
|
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
oauthlib/oauth2/rfc6749/grant_types/authorization_code.py | 8 +++++---
|
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
|
|
index 09dc619..c73314a 100644
|
|
--- a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
|
|
+++ b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py
|
|
@@ -4,6 +4,7 @@ oauthlib.oauth2.rfc6749.grant_types
|
|
"""
|
|
import base64
|
|
import hashlib
|
|
+import hmac
|
|
import json
|
|
import logging
|
|
|
|
@@ -44,9 +45,10 @@ def code_challenge_method_s256(verifier, challenge):
|
|
|
|
.. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
|
|
"""
|
|
- return base64.urlsafe_b64encode(
|
|
+ expected = base64.urlsafe_b64encode(
|
|
hashlib.sha256(verifier.encode()).digest()
|
|
- ).decode().rstrip('=') == challenge
|
|
+ ).decode().rstrip('=')
|
|
+ return hmac.compare_digest(expected, challenge)
|
|
|
|
|
|
def code_challenge_method_plain(verifier, challenge):
|
|
@@ -58,7 +60,7 @@ def code_challenge_method_plain(verifier, challenge):
|
|
|
|
.. _`Section 4.3`: https://tools.ietf.org/html/rfc7636#section-4.3
|
|
"""
|
|
- return verifier == challenge
|
|
+ return hmac.compare_digest(verifier, challenge)
|
|
|
|
|
|
class AuthorizationCodeGrant(GrantTypeBase):
|