Rhonabwy Project vulnerabilities
We track 3 vulnerabilities in Rhonabwy Project products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 11, 2024.
Latest Rhonabwy Project vulnerabilities
- 9.8 Critical severity
rhonabwy: Observable Discrepancy
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has consta
- 7.5 High severity
Rhonabwy: Use of a Broken or Risky Cryptographic Algorithm
Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.
- 7.5 High severity
Rhonabwy: Buffer Copy without Checking Size of Input
Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted JWE token.