critical9.8
CVE-2024-25189
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Impact
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Debian | Debian Linux | Version 10.0 |
| Libjwt | Libjwt | Version 1.15.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/P3ngu1nW/CVE_Request/blob/main/benmcollins%3Alibjwt.md
- https://lists.debian.org/debian-lts-announce/2024/02/msg00009.html
- https://github.com/P3ngu1nW/CVE_Request/blob/main/benmcollins%3Alibjwt.md
- https://lists.debian.org/debian-lts-announce/2024/02/msg00009.html