CVE-2022-48566

Severity Score

5.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

*Credits: N/A

CVSS Scores

NISTv3.1 5.9

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-07-23 CVE Reserved
2023-08-22 CVE Published
2024-09-23 EPSS Updated
2024-10-03 CVE Updated
2024-10-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CAPEC

References (4)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html	Mailing List
https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html	Mailing List
https://security.netapp.com/advisory/ntap-20231006-0013	Third Party Advisory

URL	Date	SRC
https://bugs.python.org/issue40791	2024-10-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				< 3.6.13 Search vendor "Python" for product "Python" and version " < 3.6.13"		-		Affected
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				>= 3.7.0 < 3.7.10 Search vendor "Python" for product "Python" and version " >= 3.7.0 < 3.7.10"		-		Affected
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				>= 3.8.0 < 3.8.7 Search vendor "Python" for product "Python" and version " >= 3.8.0 < 3.8.7"		-		Affected
Python Search vendor "Python"		Python Search vendor "Python" for product "Python"				>= 3.9.0 < 3.9.1 Search vendor "Python" for product "Python" and version " >= 3.9.0 < 3.9.1"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Netapp Search vendor "Netapp"		Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager"				-		vmware_vsphere		Affected
Netapp Search vendor "Netapp"		Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager"				-		windows		Affected
Netapp Search vendor "Netapp"		Converged Systems Advisor Agent Search vendor "Netapp" for product "Converged Systems Advisor Agent"				-		-		Affected