GitHub Advisoryadvisory · Go

GHSA-6m9h-2pr2-9j8f 1Panel's password verification is suspected to have a timing attack vulnerability

LOW Published 2024-04-18 Modified 2025-02-11 Official page ↗
Aliases
CVE-2024-30257
Ecosystem
Go
Packages
github.com/1Panel-dev/1Panel
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203
Reviewed
2024-04-18

Affected packages

• Go github.com/1Panel-dev/1Panel: < 1.10.3 → fixed in 1.10.3

Description

Summary 源码中密码校验处使用 != 符号，而不是`hmac.Equal`，这可能导致产生计时攻击漏洞，从而爆破密码。 建议使用 `hmac.Equal` 比对密码。 Translation: The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords. Details https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26 Impact 该产品的所有使用者。 Translation: All users of this product.

Related

Alias · CVE (1)

  • CVE-2024-30257 1Panel is an open source Linux server operation and maintenance management panel. vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References