CVE-2024-25714
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first differe…
Published: 2024-02-11 · CVSS: 9.1 · CVSS 3.1
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7