Timing Attack

2023-08-3022:30:54

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

python3.9

improper access control

hmac.py

timing attack

cryptographic applications

software

0.001 Low

EPSS

Percentile

22.9%

JSON

python3.9 is vulnerable to Improper Access Control. The vulnerability exists due to a flaw in the way the hmac.compare_digest() function in the Lib/hmac.py module compares two message digests. An attacker can exploit this vulnerability to distinguish between different message digests, which could be used to defeat certain cryptographic applications.

CPENameOperatorVersion
python3.9:bullseyeeq3.9.0-5
python2.7:bullseyeeq2.7.18-5
python2.7:bullseyeeq2.7.18-1
python2.7:bustereq2.7.16-2+deb10u1
python3.9:bullseyeeq3.9.0-5
python2.7:bullseyeeq2.7.18-5
python2.7:bullseyeeq2.7.18-1
python2.7:bustereq2.7.16-2+deb10u1
python3.7:bustereq3.7.3-2+deb10u3
python3.7:bustereq3.7.3-2+deb10u2

Name	Operator	Version
python3.9:bullseye	eq	3.9.0-5
python2.7:bullseye	eq	2.7.18-5
python2.7:bullseye	eq	2.7.18-1
python2.7:buster	eq	2.7.16-2+deb10u1
python3.9:bullseye	eq	3.9.0-5
python2.7:bullseye	eq	2.7.18-5
python2.7:bullseye	eq	2.7.18-1
python2.7:buster	eq	2.7.16-2+deb10u1
python3.7:buster	eq	3.7.3-2+deb10u3
python3.7:buster	eq	3.7.3-2+deb10u2