An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python38-debugUpgrade python-libsUpgrade python-testUpgrade tkinterUpgrade python38-libsUpgrade python3-testUpgrade python38-debuginfoUpgrade python38-develUpgrade pythonUpgrade python3-toolsUpgrade python-toolsUpgrade python3Upgrade python38Upgrade python38-toolsUpgrade python-develUpgrade python3-debuginfoUpgrade python3-tkinterUpgrade python3-develUpgrade python3-libsUpgrade python3-debugUpgrade python38-tkinterUpgrade python-debuginfoUpgrade python-debugUpgrade python38-test | Jan 10, 2024 | Aug 22, 2023 |
| Debian | — | Upgrade python3.9Upgrade pypy3Upgrade python2.7 | Sep 22, 2023 | Aug 22, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pythonUpgrade tkinterUpgrade python-libsUpgrade python-devel | Feb 12, 2024 | Aug 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-testUpgrade python2Upgrade python2-develUpgrade python2-libsUpgrade python-unversioned-command | Mar 13, 2024 | Aug 22, 2023 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 22, 2023 |
| Suse | — | Upgrade python-32bitUpgrade python-docUpgrade python-demoUpgrade pythonUpgrade python-tkUpgrade libpython2_7-1_0-32bitUpgrade python-idleUpgrade python-baseUpgrade libpython2_7-1_0Upgrade python-doc-pdfUpgrade python-base-32bitUpgrade python-gdbmUpgrade python-cursesUpgrade python-develUpgrade python-xml | Oct 10, 2023 | Aug 22, 2023 |
| Ubuntu | — | Upgrade python2.7Upgrade python3.5 (Ubuntu Pro)Upgrade libpython3.5-stdlib (Ubuntu Pro)Upgrade python3.6 (Ubuntu Pro)Upgrade python3.6-minimal (Ubuntu Pro)Upgrade libpython2.7 (Ubuntu Pro)Upgrade python3.8-minimal (Ubuntu Pro)Upgrade python3.7 (Ubuntu Pro)Upgrade python3.5-minimal (Ubuntu Pro)Upgrade python3.7-minimal (Ubuntu Pro)Upgrade libpython2.7-minimal (Ubuntu Pro)Upgrade libpython3.5 (Ubuntu Pro)Upgrade python3.8 (Ubuntu Pro)Upgrade libpython2.7-stdlib (Ubuntu Pro)Upgrade libpython3.5-minimal (Ubuntu Pro) | Sep 28, 2023 | Aug 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub