{"id":"CVE-2017-12872","published":"2017-09-01T21:00:00Z","modified":"2024-08-05T18:51:06Z","title":"The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp…","vendor":null,"product":null,"tier":"tail","description":{"text":"The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01459,"percentile":0.73455,"provenance":"source"},"cwes":[],"references":[{"url":"https://simplesamlphp.org/security/201703-01","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":14.7,"factors":[{"name":"EPSS percentile","points":14.69}]},"affected":[{"ecosystem":"Packagist","package":"simplesamlphp/simplesamlphp","vulnerableRanges":["<1.15.0-rc1"],"patched":["1.15.0-rc1"],"from":["GHSA-v882-949x-6v28"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5314","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-12867","published":"2017-08-29","fixed":"1.14.15","kev":false},{"cve":"CVE-2017-18121","published":"2018-02-02","fixed":"1.14.16","kev":false},{"cve":"CVE-2017-18122","published":"2018-02-02","fixed":"1.14.17","kev":false},{"cve":"CVE-2017-12872","published":"2017-09-01","fixed":"1.15.0-rc1","kev":false},{"cve":"CVE-2018-6520","published":"2018-02-02","fixed":"1.15.2","kev":false,"link":{"from":"CVE-2017-12872","to":"CVE-2018-6520","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:simplesamlphp/simplesamlphp","fromFixed":"1.15.0-rc1","toFixed":"1.15.2","daysApart":154}]}},{"cve":"CVE-2018-6521","published":"2018-02-02","fixed":"1.15.2","kev":false,"link":{"from":"CVE-2017-12872","to":"CVE-2018-6521","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:simplesamlphp/simplesamlphp","fromFixed":"1.15.0-rc1","toFixed":"1.15.2","daysApart":154}]}},{"cve":"CVE-2020-5225","published":"2020-01-24","fixed":"1.18.4","kev":false}],"package":"Packagist:simplesamlphp/simplesamlphp"}}