Описание
H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9.
Ссылки
- Issue Tracking
- Patch
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:h3:h3:2.0.0:*:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc1:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc2:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc3:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc4:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc5:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc6:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc7:*:*:*:node.js:*:*
cpe:2.3:a:h3:h3:2.0.1:rc8:*:*:*:node.js:*:*
EPSS
Процентиль: 24%
0.00319
Низкий
5.9 Medium
CVSS3
Дефекты
CWE-208
Связанные уязвимости
CVSS3: 5.9
github
5 месяцев назад
h3 has an observable timing discrepancy in basic auth utils
EPSS
Процентиль: 24%
0.00319
Низкий
5.9 Medium
CVSS3
Дефекты
CWE-208