Authentication flaw

php-jwt 1.0.0 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

UBUNTU-CVE-2024-25189

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

Authentication flaw

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

Authentication flaw

l8w8jwt 2.2.1 uses memcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

UBUNTU-CVE-2024-25191

php-jwt 1.0.0 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

CVE-2024-25189

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

Timing Attack

pulsar-broker-auth-sasl is vulnerable to a Timing Attack. The vulnerability is due to the verifyAndExtract function within SaslRoleTokenSigner.java because it take different amounts of time to return false depending on how many characters it needs to compare before finding a mismatch. This...

CVE-2024-25191

php-jwt 1.0.0 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

CVE-2024-25190

l8w8jwt 2.2.1 uses memcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

CVE-2024-25191

CVE-2024-25191 affects the PHP-JWT library (version 1.0.0). The vulnerability arises because authentication verification uses strcmp, which is not constant-time, enabling bypass of authentication via a timing side channel. Documented impact is high: network access with no privileges required, and...

RHEL 8 : container-tools:4.0 (RHSA-2024:0748)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0748 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: runc: file...

CVE-2024-25189

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

CVE-2024-25191

php-jwt 1.0.0 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

CVE-2024-25190

CVE-2024-25190 affects l8w8jwt v2.2.1, where authentication is verified using memcmp, which is not constant time. This creates a timing-side-channel vulnerability that can lead to authentication bypass. Several sources (Red Hat, NVD, OSV, CVE lists, and vendor/problem reports) describe the issue ...

PT-2024-20807 · Php-Jwt · Php-Jwt

Name of the Vulnerable Software and Affected Versions: php-jwt version 1.0.0 Description: The issue arises from the use of strcmp to verify authentication, which is not a constant-time comparison. This makes it easier for attackers to bypass authentication via a timing side channel...

CVE-2024-25189

The CVE concerns libjwt: 1.15.3 uses strcmp (not constant time) to verify authentication, enabling a timing side‑channel bypass. Connected sources confirm this is a legitimate vulnerability with high impact (CVE-2024-25189) and note Debian LTS advisories and Debian/DLA entries recommending an upg...

CVE-2024-25189

libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

Fedora 38 : gnutls (2024-c43a6cc3f8)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c43a6cc3f8 advisory. Rebase gnutls to version 3.8.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

CVE-2024-25190

l8w8jwt 2.2.1 uses memcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...

ALSA-2024:0748 Important: container-tools:4.0 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: runc: file descriptor leak "Leaky Vessels" CVE-2024-21626 A AlmaLinux Security Bulletin which addresses further details about the Leaky Vessels flaw is available in th...