CVE-2022-48566: Race Condition
An issue was discovered in comparedigest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.comparedigest.
Other sources
Python could allow a local authenticated attacker to obtain sensitive information, caused by a constant-time-defeating optimisations issue in the comparedigest function in Lib/hmac.py. By sending a specially crafted request using the accumulator variable in hmac.comparedigest, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-48566?
CVE-2022-48566 is a vulnerability discovered in Python through 3.9.1 that allows for constant-time-defeating optimizations in the accumulator variable of hmac.compare_digest.
How severe is CVE-2022-48566?
CVE-2022-48566 has a severity score of 8.1, which is classified as high.
What software is affected by CVE-2022-48566?
Python versions 3.6.0 through 3.9.1 are affected. Additionally, specific versions of Python 2.7 and 3.5 for Ubuntu and Python 2.7, 3.7, and 3.9 for Debian are also affected.
How can I fix CVE-2022-48566?
To fix CVE-2022-48566, update your Python installation to the latest patched version available for your operating system.
Where can I find more information about CVE-2022-48566?
More information about CVE-2022-48566 can be found at the following references: [1] [2] [3]