What’s Vulnerable › Vulnerabilities

CVE-2022-48566

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-22 · updated 2026-06-17
• Weakness: CWE-362

Description

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

Affected products

• Debian Linux: 10.0
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Converged Systems Advisor Agent: all versions
• Python: before 3.6.13; from 3.7.0 before 3.7.10; from 3.8.0 before 3.8.7; from 3.9.0 before 3.9.1 — fixed in 3.6.13, 3.7.10, 3.8.7, 3.9.1

How to fix

Upgrade to a fixed version: Python 3.6.13, 3.7.10, 3.8.7, 3.9.1. Check the vendor advisory for mitigations.

References

• https://bugs.python.org/issue40791
• https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
• https://security.netapp.com/advisory/ntap-20231006-0013/
• https://bugs.python.org/issue40791
• https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html
• https://security.netapp.com/advisory/ntap-20231006-0013/

Get alerted when CVE-2022-48566 or the next vulnerability affects your stack