Fluid Attacks Database

Description

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	pypy3	>=0 <7.3.5+dfsg-2	7.3.5+dfsg-2
debian 12	pypy3	>=0 <7.3.5+dfsg-2	7.3.5+dfsg-2
debian 13	pypy3	>=0 <7.3.5+dfsg-2	7.3.5+dfsg-2
debian 14	pypy3	>=0 <7.3.5+dfsg-2	7.3.5+dfsg-2
debian 11	python2.7	=2.7.18-8 \|\| >=0 <2.7.18-8+deb11u1	2.7.18-8+deb11u1
debian 11	python3.9	>=0 <3.9.1~rc1-1	3.9.1~rc1-1
rpm rhel6	python	-	-
rpm rhel7	python	-	-
rpm rhel7	python3	-	-

Aliases

1. CVE-2022-485662. NVD-2022-485663. OSV-DEBIAN-2022-485664. OSV-2022-485665. SECURITY-TRACKER-CVE-2022-48566

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.