Lucene search
Veracode Vulnerability DatabaseVERACODE:11966HistoryJan 15, 2019 - 9:10 a.m.
Timing Attack Vulnerability In Basic Authentication
2019-01-1509:10:28
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
0.019 Low
EPSS
Percentile
88.6%
Action Controller in the actionpack gem has a flaw in the way it compares usernames and passwords in the basic authentication authorization code. Due to the flaw, attackers can launch a timing attack by analyzing the time taken by a response and use the difference to find a valid username and password.
Related
ubuntucve
ubuntucve
CVE-2015-7576
2016-02-16 00:00:00
osv
osv
ruby-activesupport-3.2 - security update
2016-08-27 00:00:00
actionpack is vulnerable to remote bypass authentication
2017-10-24 18:33:36
ruby-actionpack-3.2 - security update
2016-08-28 00:00:00
openvas
openvas
Fedora Update for rubygem-activesupport FEDORA-2016-3
2016-02-29 00:00:00
Debian: Security Advisory (DLA-603-1)
2023-03-08 00:00:00
Ruby on Rails Multiple Vulnerabilities-01 (Oct 2016) - Linux
2016-10-17 00:00:00
github
github
actionpack is vulnerable to remote bypass authentication
2017-10-24 18:33:36
hackerone
hackerone
Ruby on Rails: http_basic_authenticate_with is suseptible to timing attacks.
2015-10-19 11:01:33
fedora
fedora
[SECURITY] Fedora 23 Update: rubygem-activesupport-4.2.3-3.fc23
2016-02-28 12:28:58
[SECURITY] Fedora 22 Update: rubygem-activesupport-4.2.0-4.fc22
2016-02-28 08:31:16
[SECURITY] Fedora 23 Update: rubygem-actionpack-4.2.3-4.fc23
2016-02-28 12:29:15
prion
prion
Authentication flaw
2016-02-16 02:59:00
nessus
nessus
Fedora 23 : rubygem-activesupport-4.2.3-3.fc23 (2016-3ede04cd79)
2016-03-04 00:00:00
Debian DLA-603-1 : ruby-activesupport-3.2 security update
2016-08-29 00:00:00
Fedora 22 : rubygem-activesupport-4.2.0-4.fc22 (2016-cb30088b06)
2016-03-04 00:00:00
cve
cve
CVE-2015-7576
2016-02-16 02:59:00
debiancve
debiancve
CVE-2015-7576
2016-02-16 02:59:00
cvelist
cvelist
CVE-2015-7576
2016-02-16 02:00:00
nvd
nvd
CVE-2015-7576
2016-02-16 02:59:00
rubygems
rubygems
Timing attack vulnerability in basic authentication in Action Controller.
2016-01-24 21:00:00
debian
debian
[SECURITY] [DLA 603-1] ruby-activesupport-3.2 security update
2016-08-27 16:25:23
[SECURITY] [DLA 604-1] ruby-actionpack-3.2 security update
2016-08-28 18:14:37
[SECURITY] [DSA 3464-1] rails security update
2016-01-31 18:43:51
redhat
redhat
(RHSA-2016:0296) Important: rh-ror41 security update
2016-02-24 00:00:00
(RHSA-2016:0455) Important: ruby193 security update
2016-03-15 00:00:00
(RHSA-2016:0454) Important: ror40 security update
2016-03-15 00:00:00
freebsd
freebsd
rails -- multiple vulnerabilities
2016-01-25 00:00:00
ibm
ibm
suse
suse
Security update for portus (important)
2016-04-25 20:07:56