CVE-2021-37848

2021-08-0220:15:08

Google

osv.dev

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

57.5%

JSON

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.

CPENameOperatorVersion
bareboxeq2014.09.0
bareboxeq2019.01.0
bareboxeq2010.05.0
bareboxeq2020.10.0
bareboxeq2020.09.0
bareboxeq2012.02.0
bareboxeq2018.03.0
bareboxeq2010.12.0
bareboxeq2013.02.0
bareboxeq2011.11.0

Name	Operator	Version
barebox	eq	2014.09.0
barebox	eq	2019.01.0
barebox	eq	2010.05.0
barebox	eq	2020.10.0
barebox	eq	2020.09.0
barebox	eq	2012.02.0
barebox	eq	2018.03.0
barebox	eq	2010.12.0
barebox	eq	2013.02.0
barebox	eq	2011.11.0