authentik 安全漏洞

authentik is an open source identity provisioning application from authentik open source. Authentik suffers from a security vulnerability that stems from an issue with the use of non-constant time comparisons in the /-/metrics/ endpoint, which makes SECRETKEY vulnerable to brute-force cracking...

GHSA-J757-PF57-F8R4 Gradio performs a non-constant-time comparison when comparing hashes

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of differen...

Gradio 安全漏洞

Gradio, an open source Python library open-sourced by Hugging Face, is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from a security vulnerability that stems from the fact that comparisons are not done in constant time, which can be exploited by an...

CVE-2024-45678

Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack that requires physical access and expensive equipment in which an electromagnetic side channel is present because of a non-constant-time modular...

CVE-2024-41828

In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time...

CVE-2024-41828

In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time...

CVE-2024-41828

CVE-2024-41828 affects JetBrains TeamCity prior to 2024.07, where the comparison of authorization tokens is performed in non-constant time. Red Hat and vendor advisories corroborate this, indicating the root cause is timing-related handling of tokens that can impact confidentiality. The vulnerabi...

PT-2024-5489 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.07 Description: The issue is related to a flaw in the authorization procedure of JetBrains TeamCity, a continuous integration and continuous deployment CI/CD system. This flaw arises from the...

GHSA-J8CM-G7R6-HFPQ vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material

Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw might allow an attacker to infer some information about the secret key material through a side-channel attack. Impa...

RUSTSEC-2024-0354 Usage of non-constant time base64 decoder could lead to leakage of secret key material

Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw might allow an attacker to infer some information about the secret key material through a side-channel attack. Impa...

Information Disclosure Through Timing Attack

mdanter/ecc is vulnerable to Sensitive Information Disclosure. The vulnerability is due to computing point addition in a non constant time, which allows an attacker to deduce the private key by comparing the time it takes to compute each point addition...

RUSTSEC-2024-0333 `rsa-export` is unmaintained

This crate has been deprecated in favour of using the native support for exporting RSA keys into the standard PEM format. See docs.rs documentation. In addition to that, the operations in this crate arithmetic and Base64 encoding are not done in constant-time, potentially exposing the user to...

PT-2024-40907 · Rsa · Rsa

Name of the Vulnerable Software and Affected Versions: rsa affected versions not specified Description: The issue concerns potential side-channel attacks due to non-constant time operations, including arithmetic and Base64 encoding. Recommendations: At the moment, there is no information about a...

CVE-2023-33855

Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture CCA 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack. IBM X-Force ID: 257676...

CVE-2023-33855

CVE-2023-33855 affects IBM Common Cryptographic Architecture (CCA) used with the IBM 4769 Developer’s Toolkit. Affected versions are CCA 7.0.0 through 7.5.36, where RSA operations may exhibit non-constant-time behavior under certain conditions, potentially allowing a remote attacker to obtain sen...

CVE-2023-33855 IBM Common Cryptographic Architecture information disclosure

Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture CCA 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack. IBM X-Force ID: 257676...

DEBIAN-CVE-2024-25189

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

Authentication flaw

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

UBUNTU-CVE-2024-25189

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

CVE-2024-23903

Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...