{"id":"CVE-2022-29185","aliases":["RUSTSEC-2022-0018","GHSA-8vxv-2g8p-2249"],"title":"Timing attack","summary":"Timing attack","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","vendor":"totp-rs","product":"totp-rs","ecosystem":"rust","affected":["totp-rs >= 0.0.0-0, < 1.1.0"],"patched":["totp-rs 1.1.0"],"published":"2022-05-09","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:03.407014913Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0018","references":[{"url":"https://crates.io/crates/totp-rs"},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0018.html"},{"url":"https://github.com/constantoine/totp-rs/issues/13"}],"tags":["osv","rust"],"epss":0.00863,"epssPercentile":0.58412,"ingestedAt":"2026-10-13T11:45:30.155Z","slug":"CVE-2022-29185","body":"## Overview\n\nAffecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user.\n\nThis has been fixed by using using the crate constant_time_eq for comparison.\n\n## Affected packages\n\n- `totp-rs >= 0.0.0-0, < 1.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `totp-rs 1.1.0`","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}