Bug 2238753 (CVE-2022-48566)

Summary:	CVE-2022-48566 python: constant-time-defeating optimisations issue in the compare_digest function in Lib/hmac.p
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	hhorak, jorton, python-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A constant-time-defeating optimization issue was found in python. This issue occurs when sending a specially crafted request, which could allow an attacker to obtain sensitive information.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2238756, 2238757, 2238758, 2238759, 2238760, 2238761
Bug Blocks:	2238762

Description msiddiqu 2023-09-13 13:30:37 UTC

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

Comment 1 msiddiqu 2023-09-13 13:46:31 UTC

References: 
 
https://github.com/python/cpython/issues/84968
https://bugs.python.org/issue40791

Comment 2 msiddiqu 2023-09-13 13:59:07 UTC

Created python3.10 tracking bugs for this issue:

Affects: fedora-all [bug 2238756]


Created python3.6 tracking bugs for this issue:

Affects: fedora-all [bug 2238757]


Created python3.7 tracking bugs for this issue:

Affects: fedora-all [bug 2238758]


Created python3.8 tracking bugs for this issue:

Affects: fedora-all [bug 2238759]


Created python3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2238760]