CVE-2024-23771

9.8CRITICAL

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Publicado: 1/22/2024Atualizado: 5/30/2025
Ver no NVDVer no MITRE

Descrição

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Análise IADesenvolvido por IA

Produtos Afetados

unix4lyfedarkhttpd

Referências