Vulnerability in Constantoine Totp-Rs
CVE-2022-29185
totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Starting with patched version 1.1.0, the library uses constant-time comparison. There are currently no known workarounds.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.009 (56.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 56.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.009 · change: +0.000
Affected products
- Constantoine Totp-Rs — versions <1.1.0
- Totp-Rs Project
Weakness classification (CWE)
References
- github.com/constantoine/totp-rs/security/advisories/GHSA-8vxv-2g8p-2249 (Third Party Advisory)
- github.com/constantoine/totp-rs/issues/13 (Third Party Advisory, Issue Tracking)
- github.com/constantoine/totp-rs/releases/tag/v1.1.0 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2022-29185?
- CVE-2022-29185 is a medium-severity vulnerability in Constantoine Totp-Rs, classified under Observable Discrepancy. CVSS score: 4.2/10. Published 2022-05-20.
- How severe is CVE-2022-29185?
- Medium severity. CVSS v3 base score is 4.2 out of 10.