PT-2024-40253 · Adyen · Adyen

Published 2024-08-30 · Updated 2024-08-30

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Adyen (affected versions not specified)

Description: The issue concerns the is valid hmac and is valid hmac notification methods, which are vulnerable to a timing attack. To mitigate this, it is recommended to compare the hash of the HMACs instead of directly comparing the HMACs.

Recommendations: For all affected versions, consider modifying the is valid hmac and is valid hmac notification methods to compare the hash of the HMACs instead of directly comparing the HMACs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

GHSA-F3Q4-GGFP-JV34

Affected Products

Adyen

References · 6

• https://osv.dev/vulnerability/GHSA-f3q4-ggfp-jv34 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/adyen/PYSEC-2023-1.yaml · Note
• https://github.com/Adyen/adyen-python-api-library/commit/3292133dbc00ffc4cccfb92de672a76eaa587ca5 · Note
• https://github.com/Adyen/adyen-python-api-library/pull/170 · Note
• https://github.com/Adyen/adyen-python-api-library/issues/168 · Note
• https://github.com/Adyen/adyen-python-api-library · Note