CVE-2022-29185
Medium
Description
totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Starting with patched version 1.1.0, the library uses constant-time comparison. There are currently no known workarounds.
SeverityMedium
CVSS4.2
Exploit probability59. percentile0.9%
ProductTotp-rs
PublishedMay 20, 2022
First seenMay 20, 2022
Weakness typeCWE-208CWE-208CWE-203CWE-203
How to fix
Update
- totp-rs_project totp-rs1.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| totp-rs_project totp-rs | v < 1.1.0 | 1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.