Security vulnerabilities and automated fixes for hmac issues
3 posts found
The Telegram OAuth provider in Hybridauth relied on `strcmp()` to validate HMAC-SHA256 signatures, exposing a timing side-channel that could allow attackers to forge authentication tokens character by character. The fix replaces this with PHP's timing-safe `hash_equals()` function, eliminating the information leak.
A critical code injection vulnerability in `command-palette/dynamic-commands.js` allowed arbitrary JavaScript to execute in the browser's privileged chrome context by passing unsanitized code from a user-controlled settings file directly into `Cu.evalInSandbox()`. The fix introduces an HMAC-based trust system that cryptographically hashes each custom command's code and requires explicit user approval before execution. This prevents attackers who can write to the settings file from silently injec
A medium-severity vulnerability in `daemon/src/odl_tb5_daemon_sync_proto.c` allowed any network entity that could reach the daemon's listening port to send crafted sync protocol messages without any authentication challenge. The fix introduces HMAC-SHA256 message authentication tags stamped directly into the sync header's reserved field, ensuring that only peers with the correct pre-shared key can send messages that the daemon will accept. This closes a significant attack surface that could have