Описание
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
A flaw was found in memcached. This vulnerability involves a timing side channel during SASL (Simple Authentication and Security Layer) password database authentication. A remote attacker could potentially exploit the timing differences in the password verification process to infer sensitive password data. This could lead to unauthorized access to the memcached instance.
Меры по смягчению последствий
To mitigate this issue, restrict network access to the memcached service to only trusted clients and networks using firewall rules. If SASL authentication is not strictly required, consider disabling it. If SASL is necessary, ensure that strong, unique passwords are used and rotated regularly.
Example firewall rule (adjust port and source as needed):
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_RANGE>" port port="11211" protocol="tcp" accept'
firewall-cmd --reload
To bind memcached to localhost, edit /etc/sysconfig/memcached and set OPTIONS="-l 127.0.0.1". Restart the memcached service:
systemctl restart memcached
Note that restarting the memcached service will clear all cached data.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | memcached | Fix deferred | ||
| Red Hat Enterprise Linux 6 | memcached | Fix deferred | ||
| Red Hat Enterprise Linux 7 | memcached | Fix deferred | ||
| Red Hat Enterprise Linux 8 | memcached | Fix deferred | ||
| Red Hat Enterprise Linux 9 | memcached | Fix deferred | ||
| Red Hat Hardened Images | memcached-main-1.6.42-0.1.hum1 | Fixed | RHSA-2026:23261 | 04.06.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
In memcached before 1.6.42, password data for SASL password database a ...
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
EPSS
5.9 Medium
CVSS3