CVE-2024-25714

Published February 11th, 2024

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)

babelouest/rhonabwy

[PROJECT CLOSED] - Javascript Object Signing and Encryption (JOSE) library - JWK, JWKS, JWS, JWE and JWT

GitHub