GHSA-J8CM-G7R6-HFPQ vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material

🗓️ 17 Jul 2024 18:30:55Reported by GoogleType

osv🔗 osv.dev👁 11 Views

Versions before 0.7.0 of vodozemac use non-constant time base64 implementation for importing key material, allowing leakage of secret key info. The impact is considered low due to the need for precise timing and repeated access to the encoding processes

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2024-40640	17 Jul 202420:44	–	circl
CVE	CVE-2024-40640	17 Jul 202417:27	–	cve
Cvelist	CVE-2024-40640 Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac	17 Jul 202417:27	–	cvelist
EUVD	EUVD-2024-2372	3 Oct 202520:07	–	euvd
Github Security Blog	vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material	17 Jul 202418:30	–	github
NVD	CVE-2024-40640	17 Jul 202418:15	–	nvd
OSV	CVE-2024-40640 Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac	17 Jul 202417:27	–	osv
OSV	RUSTSEC-2024-0354 Usage of non-constant time base64 decoder could lead to leakage of secret key material	17 Jul 202412:00	–	osv
Positive Technologies	PT-2024-28958 · Vodozemac · Vodozemac	17 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-40640	23 May 202507:32	–	redhatcve

Source	Link
github	www.github.com/matrix-org/vodozemac/security/advisories/GHSA-j8cm-g7r6-hfpq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-40640
github	www.github.com/matrix-org/vodozemac/commit/734b6c6948d4b2bdee3dd8b4efa591d93a61d272
github	www.github.com/matrix-org/vodozemac/commit/77765dace11266ef9523301624a01265c6e0f790
arxiv	www.arxiv.org/abs/2108.04600
github	www.github.com/matrix-org/vodozemac
rustsec	www.rustsec.org/advisories/RUSTSEC-2024-0354.html

18 Nov 2024 16:26Current

3.4Low risk

Vulners AI Score3.4

CVSS 3.13.7

CVSS 46.3

EPSS0.00201