critical9.8
CVE-2024-23771
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication vi…
Impact
darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Unix4lyfe | Darkhttpd | before 1.15 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2024/01/25/1
- https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04
- https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15
- http://www.openwall.com/lists/oss-security/2024/01/25/1
- https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04
- https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15