{"action":"Upgrade adyen to 7.1.0 or later.","affected":[{"fixed":"7.1.0","introduced":"2.2.0"}],"component":"adyen","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["7.1.0"],"id":"tcs_01M5KGJ8N39WB2NN4SPV6PSY85","modified_at":"2023-01-24T00:00:00Z","published_at":"2023-01-24T00:00:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-1","https://github.com/Adyen/adyen-python-api-library/issues/168","https://github.com/Adyen/adyen-python-api-library/pull/170"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-1","url":"https://osv.dev/vulnerability/PYSEC-2023-1"}],"summary":"Adyen has utility methods for validating notification HMAC signatures. The is_valid_hmac and is_valid_hmac_notification methods are vulnerable to a timing attack, you should compare the hash of the HM"}