CVE-2024-23771

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authenti...

Original description

The description as published by the source.

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2024-23771 darkhttpd Fixed in: 1.15-r0

References

advisory github.com
advisory nvd.nist.gov
patch github.com
web github.com
web openwall.com