[Secure-testing-team] Bug#738515: oath-tookit: CVE-2013-7322: certain one-time-passwords not invalidated correctly

[Salvatore Bonaccorso]

Package: oath-tookit
Severity: grave
Tags: security upstream

Hi,

the following vulnerability was published for oath-toolkit. It is to
track the isse both in BTS and security tracker.

CVE-2013-7322[0]:
certain one-time-passwords not invalidated correctly

A possible pach is found at [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] http://security-tracker.debian.org/tracker/CVE-2013-7322
[1] http://lists.nongnu.org/archive/html/oath-toolkit-help/2013-12/txtUm85v7Wqcy.txt

Regards,
Salvatore