CVE-2022-29185

low-risk
Published 2022-05-20

totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Starting with patched version 1.1.0, the library uses constant-time comparison. There are currently no known workarounds.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.2/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Totp-Rs

Affected Vendors

Totp-Rs Project

References (6)

Issue Tracking https://github.com/constantoine/totp-rs/issues/13
Release Notes https://github.com/constantoine/totp-rs/releases/tag/v1.1.0
Third Party Advisory https://github.com/constantoine/totp-rs/security/advisories/GHSA-8vxv-2g8p-2249
Issue Tracking https://github.com/constantoine/totp-rs/issues/13
Release Notes https://github.com/constantoine/totp-rs/releases/tag/v1.1.0
Third Party Advisory https://github.com/constantoine/totp-rs/security/advisories/GHSA-8vxv-2g8p-2249
20
/ 100
low-risk
Severity 14/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal