CVE-2024-25189

Опубликовано: 08 фев. 2024

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

Ссылки

https://github.com/P3ngu1nW/CVE_Request/blob/main/benmcollins%3Alibjwt.md
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00009.html
Mailing List
Third Party Advisory
https://github.com/P3ngu1nW/CVE_Request/blob/main/benmcollins%3Alibjwt.md
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00009.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:libjwt:libjwt:1.15.3:*:*:*:*:*:*:*

EPSS

Процентиль: 24%

0.00083

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-203

Связанные уязвимости

CVE-2024-25189

CVSS3: 9.8

ubuntu

почти 2 года назад

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

CVE-2024-25189

CVSS3: 9.8

debian

почти 2 года назад

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authe ...

GHSA-m5gq-732f-j9v6

CVSS3: 9.8

github

почти 2 года назад

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

EPSS

Процентиль: 24%

0.00083

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-203