CVE-2022-48566 Race condition in n/a
Timing side-channel in Python's hmac.compare_digest allows attackers to bypass constant-time protections and potentially recover secrets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48566?
CVE-2022-48566 is a medium-severity vulnerability in Debian Debian Linux, published on 22 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
Weakness: CWE-362
Which versions are affected by CVE-2022-48566?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.6.13, 3.7.10, 3.8.7, 3.9.1 |
python Bitnami | All versions | 3.6.13, 3.7.10, 3.8.7, 3.9.1 |
python-min Bitnami | All versions | 3.6.13, 3.7.10, 3.8.7, 3.9.1 |
Products include Debian Debian Linux, Netapp Active Iq Unified Manager, Netapp Converged Systems Advisor Agent, Python Python.
How do I fix CVE-2022-48566?
Upgrade libpython to a fixed version for your release line: 3.6.13, 3.7.10, 3.8.7 or 3.9.1.
Is CVE-2022-48566 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48566 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-109656, BIT-libpython-2022-48566, BIT-python-2022-48566, BIT-python-min-2022-48566, CLSA-2023-1697462566, CLSA-2023-1697463155 and 12 more.