daniel:// stenberg:// @bagder@mastodon.social
Public

It required that I looked an extra time but in the end I banned this reporter as well: hackerone.com/reports/3346118

curl disclosed on HackerOne: Timing Attack Vulnerability in curl...

## Summary: A timing attack vulnerability exists in curl's Digest Authentication implementation due to the use of non-constant-time string comparison (strcmp()) when comparing authentication algorithms in digest.c line 360. This allows attackers to determine the supported authentication algorithm through response time analysis. No AI was used to discover this vulnerability or generate this...

hackerone.com · HackerOne

0
0
1

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.social/users/bagder/statuses/115227490001822766 on your instance and quote it. (Note that quoting is not supported in Mastodon.)

0
0
0