CVE-2022-29185
Timing attack
概要
Timing attack
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Affecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user.
This has been fixed by using using the crate constant_time_eq for comparison.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
crates.io
totp-rs
[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.1.0"}]}]
参照URL
- advisory rustsec.org
- package crates.io
- report github.com