GitHub Advisoryadvisory · Packagist

GHSA-v882-949x-6v28 SimpleSAMLphp allows timing side-channel attacks

MEDIUM Published 2022-05-14 Modified 2023-07-26 Official page ↗
Aliases
CVE-2017-12872
Ecosystem
Packagist
Packages
simplesamlphp/simplesamlphp
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-07-26

Affected packages

• Packagist simplesamlphp/simplesamlphp: < 1.15.0-rc1 → fixed in 1.15.0-rc1

Description

The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.

Related

Alias · CVE (1)

  • CVE-2017-12872 The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References