httpsig-rs HMAC Timing Attack Vulnerability in Signature Verification

A timing attack vulnerability has been identified in httpsig-rs, a Rust implementation of IETF RFC 9421 HTTP message signatures. This issue affects versions prior to 0.0.19, where the HMAC signature comparison is not timing-safe. As a result, users relying on HS256 signature verification are vulnerable to this timing attack, which could allow an attacker to forge a signature.

Impact

Exploitation of this vulnerability allows for timing attacks on HMAC signature verification, enabling an attacker to forge signatures.

Remediation

Users can upgrade to httpsig-rs version 0.0.19 or later to address this vulnerability.