Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-43298

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated net

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

embedthis goahead

  • unspecified to < 5.1.4affected

References