CVE-2025-59058
httpsig-rs's HMAC verification is vulnerable to timing attack
Résumé
httpsig-rs's HMAC verification is vulnerable to timing attack
Description d'origine
La description telle que publiée par la source (souvent en anglais).
httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version 0.0.19 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com