SB2017090113 - Information disclosure in Debian Linux
Published: September 1, 2017 Updated: August 8, 2020
Security Bulletin ID
SB2017090113
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2017-12872)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.
Remediation
Install update from vendor's website.