exploitDog

CVE-2021-37848

Опубликовано: 02 авг. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.

Ссылки

https://gist.github.com/gquere/816dfadbad98745090034100a8a651eb
Exploit
Third Party Advisory
https://github.com/saschahauer/barebox/commit/a3337563c705bc8e0cf32f910b3e9e3c43d962ff
Patch
Third Party Advisory
https://gist.github.com/gquere/816dfadbad98745090034100a8a651eb
Exploit
Third Party Advisory
https://github.com/saschahauer/barebox/commit/a3337563c705bc8e0cf32f910b3e9e3c43d962ff
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:*

Версия до 2021.07.0 (включая)

EPSS

Процентиль: 74%

0.01538

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-203

Связанные уязвимости

CVE-2021-37848

CVSS3: 7.5

debian

около 5 лет назад

common/password.c in Pengutronix barebox through 2021.07.0 leaks timin ...

GHSA-52x7-8654-5f6q

CVSS3: 7.5

github

больше 4 лет назад

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.

EPSS

Процентиль: 74%

0.01538

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-203