CVE-2024-25189

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side chan...

Original description

The description as published by the source.

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-25189 libjwt Fixed in: 1.10.2-1+deb11u1
Ubuntu UBUNTU-CVE-2024-25189 libjwt

References

advisory github.com
advisory nvd.nist.gov
web github.com
web lists.debian.org