Description
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.openwall.com/lists/oss-security/2016/01/25/8 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html ↗
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html ↗
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html ↗
- http://www.securityfocus.com/bid/81803 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html ↗
- http://www.securitytracker.com/id/1034816 ↗
- http://www.debian.org/security/2016/dsa-3464 ↗
- http://rhn.redhat.com/errata/RHSA-2016-0296.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html ↗
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ ↗