Lucene search

K

GoogleOSV:GHSA-F3Q4-GGFP-JV34

HistoryAug 30, 2024 - 6:51 p.m.

Adyen APIs Library for Python timing attack vulnerability

2024-08-3018:51:58

Google

osv.dev

2

adyen

python

library

timing attack

vulnerability

notification hmac

hash comparison

software

AI Score

7.1

Confidence

High

Adyen has utility methods for validating notification HMAC signatures. The is_valid_hmac and is_valid_hmac_notification methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.

References

github.com/Adyen/adyen-python-api-library

github.com/Adyen/adyen-python-api-library/commit/3292133dbc00ffc4cccfb92de672a76eaa587ca5

github.com/Adyen/adyen-python-api-library/issues/168

github.com/Adyen/adyen-python-api-library/pull/170

github.com/pypa/advisory-database/tree/main/vulns/adyen/PYSEC-2023-1.yaml

AI Score

7.1

Confidence

High