An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python38-debugUpgrade python38-debuginfoUpgrade python38-develUpgrade pythonUpgrade python3-testUpgrade tkinterUpgrade python38-libsUpgrade python-libsUpgrade python-testUpgrade python-debuginfoUpgrade python3-tkinterUpgrade python3-debugUpgrade python38Upgrade python38-tkinterUpgrade python3Upgrade python-debugUpgrade python38-testUpgrade python-toolsUpgrade python3-develUpgrade python3-toolsUpgrade python3-debuginfoUpgrade python3-libsUpgrade python38-toolsUpgrade python-devel | Jan 10, 2024 | Aug 22, 2023 |
| Debian | — | Upgrade python3.9Upgrade python2.7Upgrade pypy3 | Sep 22, 2023 | Aug 22, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-develUpgrade python-libsUpgrade pythonUpgrade tkinter | Feb 12, 2024 | Aug 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-unversioned-commandUpgrade python2-libsUpgrade python2-testUpgrade python2-develUpgrade python2 | Mar 13, 2024 | Aug 22, 2023 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 22, 2023 |
| Suse | — | Upgrade python-xmlUpgrade python-develUpgrade python-cursesUpgrade python-tkUpgrade python-docUpgrade python-idleUpgrade python-base-32bitUpgrade pythonUpgrade libpython2_7-1_0Upgrade python-demoUpgrade python-baseUpgrade libpython2_7-1_0-32bitUpgrade python-32bitUpgrade python-gdbmUpgrade python-doc-pdf | Oct 10, 2023 | Aug 22, 2023 |
| Ubuntu | — | Upgrade python3.7 (Ubuntu Pro)Upgrade python3.5 (Ubuntu Pro)Upgrade libpython2.7 (Ubuntu Pro)Upgrade python3.6-minimal (Ubuntu Pro)Upgrade python2.7Upgrade libpython3.5-stdlib (Ubuntu Pro)Upgrade python3.6 (Ubuntu Pro)Upgrade python3.8-minimal (Ubuntu Pro)Upgrade python3.8 (Ubuntu Pro)Upgrade libpython3.5-minimal (Ubuntu Pro)Upgrade python3.7-minimal (Ubuntu Pro)Upgrade libpython3.5 (Ubuntu Pro)Upgrade libpython2.7-minimal (Ubuntu Pro)Upgrade libpython2.7-stdlib (Ubuntu Pro)Upgrade python3.5-minimal (Ubuntu Pro) | Sep 28, 2023 | Aug 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub