CVE-2024-25714: Debian Linux

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)

Affected products

• Debian Debian Linux: version 11.0 only; version 12.0 only
• Rhonabwy Project Rhonabwy: up to and including 1.1.3

Published 2024-02-11. Last modified 2026-06-17.