CVE-2024-23771: Observable Discrepancy

darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...

CVE-2024-23770

darkhttpd through 1.15 allows local users to discover credentials for --auth by listing processes and their arguments...

darkhttpd security vulnerability

darkhttpd is a software application. When you need a web server. A security vulnerability exists in darkhttpd version 1.15 and earlier that stems from allowing local users to discover credentials by listing processes and their parameters...

CVE-2024-23771

Consolidated data for CVE-2024-23771 shows that darkhttpd (C code http server) before version 1.15 uses strcmp to verify authentication, enabling timing-side-channel bypass of authentication. Multiple feeds (NVD, OSV, Fedora advisories) confirm the issue across affected releases and indicate the ...

CVE-2024-23770

darkhttpd through 1.15 allows local users to discover credentials for --auth by listing processes and their arguments...

CVE-2024-23770

Darkhttpd prior to 1.16 (notably 1.15) is affected: local users can enumerate credentials used by --auth by listing processes and their arguments. Fedora advisories/Fedora OSS notes indicate update to darkhttpd 1.16 fixes this issue. In practice, affected product: darkhttpd HTTP server; root caus...

CVE-2024-23770

darkhttpd through 1.15 allows local users to discover credentials for --auth by listing processes and their arguments...

CVE-2024-23771

darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...

CVE-2024-23771

darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...

CVE-2024-23771

darkhttpd before 1.15 uses strcmp which is not constant time to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel...

CVE-2024-23770: Undefined Security Weakness

darkhttpd through 1.15 allows local users to discover credentials for --auth by listing processes and their arguments...

PT-2024-20074

Name of the Vulnerable Software and Affected Versions darkhttpd versions 1.15 and earlier Description The issue allows local users to discover credentials by listing processes and their arguments. This is related to the --auth option. Recommendations For darkhttpd versions 1.15 and earlier,...

PT-2024-20075

Name of the Vulnerable Software and Affected Versions darkhttpd versions prior to 1.15 Description The issue arises from the use of strcmp which is not constant time to verify authentication, making it easier for remote attackers to bypass authentication via a timing side channel. This allows...

FreeBSD : darkhttpd -- DOS vulnerability (9c399521-5f80-11ed-8ac4-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9c399521-5f80-11ed-8ac4-b42e991fc52e advisory. - A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause...

Denial Of Service (DoS)

darkhttpd is vulnerable to denial of service. The vulnerability exists when accessing a file with a large modification date which allows an attacker to cause an application crash...

CVE-2020-25691

A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability...

ALPINE-CVE-2020-25691

A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability...

CVE-2020-25691

A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability...

Design/Logic Flaw

A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability...

CVE-2020-25691

A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause denial-of-service by accessing a file with a large modification date. The highest threat from this vulnerability is to system availability...