Timing Attack

jasypt is vulnerable to timing attacks. The attacks are possible because it uses Arrays.equals to verify passwords with different lengths, thereby revealing the time taken to compare the passwords...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

UBUNTU-CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

DEBIAN-CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

CVE-2014-9970 affects jasypt before 1.9.2, where a timing attack can be made against password hash comparisons. The provided documents confirm the existence of this timing vulnerability but do not specify a vendor patch or fixed version within the CVE entry. The impact is described as a confident...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

Updated radicale package fixes security vulnerability

Radicale before 1.1.2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method CVE-2017-8342...

MGASA-2017-0140 Updated radicale package fixes security vulnerability

Radicale before 1.1.2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method CVE-2017-8342...

Timing Attack

Jetty Utils is vulnerable to timing attacks. The library is vulnerable because it does not compare passwords, message digests and credentials in constant-time. This allows malicious users to use the timing of the request to progressively identify a valid passwords, message digests and credentials...

CVE-2017-7488

A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network access to the machine could enumerate users via a timing attack. Mitigation Possible workaroun...

Debian DLA-934-1 : radicale security update

Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 7 'Wheezy', these problems have been fixed in version 0.7-1.1+deb7u2. We recommend that you upgrade your radicale packages. NOTE: Tenab...

[SECURITY] [DLA 934-1] radicale security update

Package : radicale Version : 0.7-1.1+deb7u2 CVE ID : CVE-2017-8342 Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 7 "Wheezy", these problems have been fixed in version 0.7-1.1+deb7u2...

OpenJDK: ECDSA implementation timing attack (Libraries, 8168724)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protoco...

OpenJDK: DSA implementation timing attack (Libraries, 8168728)

A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel...

SUSE-SU-2017:1222-1 Security update for Botan

This update for Botan to version 1.10.9 fixes the following issues: These security issues were fixed: - CVE-2015-5726: The BER decoder in Botan 0.10.x allowed remote attackers to cause a denial of service application crash via an empty BIT STRING in ASN.1 data bsc968025. - CVE-2015-5727: The BER...

Timing Attack

github.com/btcsuite/btcd is vulnerable to timing attacks. This vulnerability is caused because hashes are not compared in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...

Timing Attack

github.com/hashicorp/vault is vulnerable to timing attacks. This vulnerability is caused because passwords are not compared in constant time, allowing malicious users to guess valid passwords based on the time that a comparison takes...

Timing Attack

github.com/openshift/origin is vulnerable to timing attacks. This vulnerability is caused because the credentials are not compared in constant time, allowing malicious users to guess the valid credentials based on the time that a comparison takes...