GHSA-f3q4-ggfp-jv34
GHSA-f3q4-ggfp-jv34 · Adyen APIs Library for Python timing attack vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Adyen has utility methods for validating notification HMAC signatures. The `is_valid_hmac` and `is_valid_hmac_notification` methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.
CVSS 6.9 · Medium · Fix available
- Published
- Updated
Stack: python
Affected products and versions
adyen PyPI
- Versions
- 2.2.0
- 2.3.0
- 3.0.0
- 3.1.0
- 4.0.0
- 5.0.0
- 5.1.0
- 6.0.0
- 7.0.0
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 7.1.0
Update to 7.1.0
Original sources
- https://github.com/Adyen/adyen-python-api-library/issues/168
- https://github.com/Adyen/adyen-python-api-library/pull/170
- https://github.com/Adyen/adyen-python-api-library/commit/3292133dbc00ffc4cccfb92de672a76eaa587ca5
- https://github.com/Adyen/adyen-python-api-library
- https://github.com/pypa/advisory-database/tree/main/vulns/adyen/PYSEC-2023-1.yaml
- https://osv.dev/vulnerability/GHSA-f3q4-ggfp-jv34