Описание
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libjwt | fixed | 1.17.0-1 | experimental | package |
| libjwt | fixed | 1.17.0-2 | package | |
| libjwt | fixed | 1.10.2-1+deb12u1 | bookworm | package |
| libjwt | fixed | 1.10.2-1+deb11u1 | bullseye | package |
Примечания
https://github.com/P3ngu1nW/CVE_Request/blob/main/benmcollins%3Alibjwt.md
https://github.com/benmcollins/libjwt/commit/f73bac57c5bece16ac24f1a70022aa34355fc1bf (v1.17.0)
https://github.com/benmcollins/libjwt/commit/a5d61ef4f1b383876e0a78534383f38159471fd6 (v1.17.0)
EPSS
Связанные уязвимости
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
EPSS