CVE-2024-23771
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authenti...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2024-23771 darkhttpd Corrigé dans: 1.15-r0
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com
- web openwall.com