CVE-2024-23771

9.8CRITICAL

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

Опубликовано: 1/22/2024Обновлено: 5/30/2025
Посмотреть на NVDПосмотреть на MITRE

Описание

darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel.

ИИ-АнализНа базе ИИ

Затронутые продукты

unix4lyfedarkhttpd

Ссылки