CVE-2024-23771

9.8CRITICAL

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Veröffentlicht: 1/22/2024Aktualisiert: 5/30/2025
Auf NVD ansehenAuf MITRE ansehen

Beschreibung

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

KI-AnalyseKI-gestützt

Betroffene Produkte

unix4lyfedarkhttpd

Referenzen