CVE-2024-23771

Summary

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/emikulic/darkhttpd/compare/v1.14…v1.15
• https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04
• http://www.openwall.com/lists/oss-security/2024/01/25/1

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://github.com/emikulic/darkhttpd/compare/v1.14…v1.15
• https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04
• http://www.openwall.com/lists/oss-security/2024/01/25/1

• ←Previous
• Next→