CVE-2022-29185

 

Published at: - 20-05-2022 10:15

Last modified: - 07-06-2022 11:19

Total changes: - 2

Description

totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Starting with patched version 1.1.0, the library uses constant-time comparison. There are currently no known workarounds.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/constantoine/totp-rs/security/advisories/GHSA-8vxv-2g8p-2249
• https://github.com/constantoine/totp-rs/issues/13
• https://github.com/constantoine/totp-rs/releases/tag/v1.1.0

 

Keywords

NVD

 

CVE-2022-29185

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures