Important: 389-ds-base

Issue Overview: Authentication bypass due to lack of size check in slapictmemcmp function in chmalloc.c: It was found that 389-ds-base did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use th...

389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c

It was found that 389-ds-base did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances...

Red Hat 389-ds-base Authentication Bypass Vulnerability

Red Hat 389-ds-base is an American Red Hat package that includes a Linux directory server and a server administration command-line program. A security vulnerability exists in Red Hat 389-ds-base, which arises from a failure of the program to properly handle internal hash comparison operations. A...

CVE-2017-15135

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare an...

UBUNTU-CVE-2017-15135

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare an...

CVE-2017-15135

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare an...

PT-2018-3497 · Red Hat +3 · 389-Ds-Base +4

Name of the Vulnerable Software and Affected Versions: 389-ds-base versions 1.3.6.1 through 1.4.0.3 Description: The issue is related to incorrect handling of internal hash comparison operations during the authentication process. This could potentially allow a remote, unauthenticated attacker to...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

Timing Attack

symfony/security is vulnerable to timing attacks. The attacks are possible because BasePasswordEncoder hashes are not compared using constant time...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

Timing Attack

emarref/jwt is vulnerable to a timing attack. It is possible because the verify function in Symmetric.php does not compare hashes in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...

Timing Attacks

kohana/core is vulnerable to timing attacks. The library is vulnerable because it does not compare hashes in constant-time, which allows attackers to use the timing of the request to progressively identify a valid hash...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

jasypt: Vulnerable to timing attack against the password hash comparison

A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...

Timing Attacks

Malcolm Fell jwt is vulnerable to timing attacks. The library does not compare hashes in constant time, which allows malicious users to use the timing of the request to progressively identify a valid hash...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

UBUNTU-CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

CVE-2014-9970 affects jasypt before 1.9.2, where a timing attack can be made against password hash comparisons. The provided documents confirm the existence of this timing vulnerability but do not specify a vendor patch or fixed version within the CVE entry. The impact is described as a confident...