VDB
Sign up
—

PYSEC-2023-1

Quick fix

PYSEC-2023-1 — adyen: upgrade to the fixed version with the command below.

pip install --upgrade 'adyen>=7.1.0'

Details

Adyen has utility methods for validating notification HMAC signatures. The is_valid_hmac and is_valid_hmac_notification methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/adyen
Introduced in: 2.2.0Fixed in: 7.1.0
Fixpip install --upgrade 'adyen>=7.1.0'

References