Skip to content

hmac.secure_compare() is not time-independent for unicode strings #59160

Description

@JonOberheide
BPO 14955
Nosy @ncoghlan, @pitrou, @vstinner, @tiran, @hynek
Dependencies
  • bpo-15061: hmac.secure_compare() leaks information about length of strings
  • Files
  • secure-compare-fix-v1.patch
  • secure-compare-fix-v2.patch
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = <Date 2012-10-06.23:34:12.885>
    created_at = <Date 2012-05-29.16:36:51.415>
    labels = ['type-security', 'library']
    title = 'hmac.secure_compare() is not time-independent for unicode strings'
    updated_at = <Date 2012-10-06.23:34:12.884>
    user = 'https://bugs.python.org/JonOberheide'

    bugs.python.org fields:

    activity = <Date 2012-10-06.23:34:12.884>
    actor = 'christian.heimes'
    assignee = 'none'
    closed = True
    closed_date = <Date 2012-10-06.23:34:12.885>
    closer = 'christian.heimes'
    components = ['Library (Lib)']
    creation = <Date 2012-05-29.16:36:51.415>
    creator = 'Jon.Oberheide'
    dependencies = ['15061']
    files = ['25756', '25801']
    hgrepos = []
    issue_num = 14955
    keywords = ['patch']
    message_count = 9.0
    messages = ['161898', '161966', '162159', '162737', '162771', '162889', '162915', '163169', '172264']
    nosy_count = 6.0
    nosy_names = ['ncoghlan', 'pitrou', 'vstinner', 'christian.heimes', 'hynek', 'Jon.Oberheide']
    pr_nums = []
    priority = 'normal'
    resolution = 'fixed'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue14955'
    versions = ['Python 3.3']

    Activity

    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions