Skip to content
Fencer Intel
critical —

GHSA-342c-vcff-2ff2 json

Login timing attack in ezsystems/ezplatform-kernel

published 4y ago modified 9mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.

Patch / fix

  • packagist ezsystems/ezplatform-kernel 1.3.19

Is GHSA-342c-vcff-2ff2 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist ezsystems/ezplatform-kernel
>=1.3.0, <1.3.19
1.3.19

Classification

Weakness
  • CWE-208 Observable Timing Discrepancy

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.