Описание
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
A flaw was found in the way the Action Controller component compared user names and passwords when performing HTTP basic authentication. Time taken to compare strings could differ depending on input, possibly allowing a remote attacker to determine valid user names and passwords using a timing attack.
Меры по смягчению последствий
Use following code to monkey-patch http_basic_authenticate_with method in ActionController:
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5.2 | ruby193-rubygem-actionpack | Will not fix | ||
| CloudForms Management Engine 5.3 | ruby193-rubygem-actionpack | Will not fix | ||
| Red Hat Subscription Asset Manager | ruby193-rubygem-actionpack | Will not fix | ||
| Red Hat Subscription Asset Manager | rubygem-actionpack | Will not fix | ||
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ror41-rubygem-actionpack | Fixed | RHSA-2016:0296 | 24.02.2016 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ror41-rubygem-actionview | Fixed | RHSA-2016:0296 | 24.02.2016 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ror41-rubygem-activemodel | Fixed | RHSA-2016:0296 | 24.02.2016 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ror41-rubygem-activerecord | Fixed | RHSA-2016:0296 | 24.02.2016 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | rh-ror41-rubygem-activesupport | Fixed | RHSA-2016:0296 | 24.02.2016 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | ror40-rubygem-actionpack | Fixed | RHSA-2016:0454 | 15.03.2016 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
The http_basic_authenticate_with method in actionpack/lib/action_contr ...
EPSS
4.3 Medium
CVSS2