CVE-2023-32694: Non-constant time HMAC comparison in Adyen plugin in Saleor
Saleor Core is a composable, headless commerce API. Saleor's validatehmacsignature function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32694?
CVE-2023-32694 has a high severity rating due to its potential for timing attacks allowing secret key disclosure.
How do I fix CVE-2023-32694?
To fix CVE-2023-32694, update your Saleor installation to a version above 3.13.16 or apply the necessary patches as outlined in the security advisories.
Which versions of Saleor are affected by CVE-2023-32694?
Saleor versions from 2.11.0 to 3.13.16 are affected by CVE-2023-32694.
What kind of attacks can be performed using CVE-2023-32694?
CVE-2023-32694 allows malicious users to conduct timing attacks to determine the secret key used for HMAC signature validation.
Does CVE-2023-32694 affect Saleor installations using the Adyen plugin?
Yes, CVE-2023-32694 specifically affects Saleor installations that have the Adyen plugin enabled.