Vulnerability in Constantoine Totp-Rs
CVE-2022-29185
totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Starting with patched version 1.1.0, the library uses constant-time comparison. There are currently no known workarounds.
EPSS: 0.008 (53.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Constantoine Totp-rs — versions <1.1.0
- Totp-rs_project Totp-rs
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2022-29185?
- CVE-2022-29185 is a medium-severity vulnerability in Constantoine Totp-Rs, classified under Observable Discrepancy. CVSS score: 4.2/10. Published 2022-05-20.
- How severe is CVE-2022-29185?
- Medium severity. CVSS v3 base score is 4.2 out of 10.