Rhonabwy vulnerabilities

3 known vulnerabilities in Rhonabwy from Rhonabwy Project. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  rhonabwy: Observable Discrepancy

  CVE-2024-25714Feb 11, 2024Rhonabwy Project

  In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has consta

• 7.5 High severity

  Rhonabwy: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2022-38493Aug 20, 2022Rhonabwy Project

  Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

• 7.5 High severity

  Rhonabwy: Buffer Copy without Checking Size of Input

  CVE-2022-32096Jul 13, 2022Rhonabwy ProjectEPSS 1.25%

  Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted JWE token.