CVE-2022-48566

Constant-time-defeating optimisations in compare_digest function

• CVSS 5.9
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• Cryptographic
• Local

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimizations were possible in the accumulator variable in hmac.compare_digest.

CVE

CVE-2022-48566

CWE

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSS base score

5.9

Published

2023-08-22

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Cryptographic

Subcategory

Cryptographic Implementation Error

Accessibility scope

Local

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Upgrade to Python 3.9.2 or later.

import hmac

def check_email_domain(email, domain):
    email = email.encode()
    domain = domain.encode()
    email_domain = email.split(b'@')[-1]
    return hmac.compare_digest(email_domain, domain)

# Test the function with some email addresses
print(check_email_domain("alice@company.example.com", "company.example.com")) # True
print(check_email_domain("bob@company.example.com", "company.example.com")) # True
print(check_email_domain("charlie@evil.com", "company.example.com")) # False
print(check_email_domain("alice@evil.com<alice@company.example.com>", "company.example.com")) # True

from email_validator import validate_email

def check_email_domain(email, domain):
    email_parts = validate_email(email)
    if email_parts.domain == domain:
        return True
    else:
        return False

# Test the function with some email addresses
print(check_email_domain("alice@company.example.com", "company.example.com")) # True
print(check_email_domain("bob@company.example.com", "company.example.com")) # True
print(check_email_domain("charlie@evil.com", "company.example.com")) # False
print(check_email_domain("alice@evil.com<alice@company.example.com>", "company.example.com")) # False

@misc{vaitp:cve202248566,
  title        = {{Constant-time-defeating optimisations in compare_digest function}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-48566},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-48566/}}
}