CVE-2023-32694

MEDIUM Year: 2023
CVSS v3 Score
5.4
Medium
Weakness Type
CWE-203
View all →

Vulnerability Description

Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16.

Related Vulnerabilities

CVE-2016-2178

MEDIUM
CVSS:5.5(Medium)

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA pri...

CWE-2032016

CVE-2018-3639

MEDIUM
CVSS:5.5(Medium)

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of in...

CWE-2032018

CVE-2019-10483

MEDIUM
CVSS:5.5(Medium)

Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electroni...

CWE-2032019

CVE-2019-14007

MEDIUM
CVSS:5.5(Medium)

Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruption in Snapdragon Auto, Snapdragon Compute,...

CWE-2032019

CVE-2019-14067

MEDIUM
CVSS:5.5(Medium)

Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi...

CWE-2032019

CVE-2019-19338

MEDIUM
CVSS:5.5(Medium)

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (T...

CWE-2032019