GHSA-v882-949x-6v28 — SimpleSAMLphp allows timing side-channel attacks

The advisory, in context

The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

simplesamlphp/simplesamlphp Packagist

Ecosystem versions

Earlier releases before 1.15.0-rc1

Fixed in 1.15.0-rc1

25 explicitly affected versions

v1.12.0, v1.13.0, v1.13.0-rc1, v1.13.0-rc2, v1.13.1, v1.13.2, v1.14.0, v1.14.0-rc1, v1.14.1, v1.14.10, v1.14.11, v1.14.12, v1.14.13, v1.14.14, v1.14.15, v1.14.16, v1.14.17, v1.14.2, v1.14.3, v1.14.4, v1.14.5, v1.14.6, v1.14.7, v1.14.8, v1.14.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.15.0-rc1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v1.12.0",
    "v1.13.0",
    "v1.13.0-rc1",
    "v1.13.0-rc2",
    "v1.13.1",
    "v1.13.2",
    "v1.14.0",
    "v1.14.0-rc1",
    "v1.14.1",
    "v1.14.10",
    "v1.14.11",
    "v1.14.12",
    "v1.14.13",
    "v1.14.14",
    "v1.14.15",
    "v1.14.16",
    "v1.14.17",
    "v1.14.2",
    "v1.14.3",
    "v1.14.4",
    "v1.14.5",
    "v1.14.6",
    "v1.14.7",
    "v1.14.8",
    "v1.14.9"
  ]
}

Set up in your agent.

Investigate in your agent.

SimpleSAMLphp allows timing side-channel attacks

The advisory, in context

Affected packages

References