CVE-2021-37847

2021-08-0220:15:08

Google

osv.dev

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.5%

JSON

crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.

CPENameOperatorVersion
bareboxeq2014.09.0
bareboxeq2019.01.0
bareboxeq2010.05.0
bareboxeq2020.10.0
bareboxeq2020.09.0
bareboxeq2012.02.0
bareboxeq2018.03.0
bareboxeq2010.12.0
bareboxeq2013.02.0
bareboxeq2011.11.0

Name	Operator	Version
barebox	eq	2014.09.0
barebox	eq	2019.01.0
barebox	eq	2010.05.0
barebox	eq	2020.10.0
barebox	eq	2020.09.0
barebox	eq	2012.02.0
barebox	eq	2018.03.0
barebox	eq	2010.12.0
barebox	eq	2013.02.0
barebox	eq	2011.11.0