GitHub Advisoryadvisory · crates.io

GHSA-8vxv-2g8p-2249 Observable Timing Discrepancy in totp-rs

MEDIUM Published 2022-05-24 Modified 2022-05-24 Official page ↗
Aliases
CVE-2022-29185
Ecosystem
crates.io
Packages
totp-rs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-203, CWE-208
Reviewed
2022-05-24

Affected packages

• crates.io totp-rs: < 1.1.0 → fixed in 1.1.0

Description

Impact Token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Patches Library now used constant-time comparison. Workarounds No. For more information If you have any questions or comments about this advisory: • Open an issue in totp-rs • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-29185 totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References