NVD

Id
28104  
Name
CVE-2015-7576  
Description
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-02-15  
Modified Date
2016-12-05  
Seq
2015-7576  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
147740 28104 CVE-2015-7576 FEDORA-2016-94e71ee673  View
147741 28104 CVE-2015-7576 FEDORA-2016-cb30088b06  View
147742 28104 CVE-2015-7576 FEDORA-2016-f486068393  View
147743 28104 CVE-2015-7576 FEDORA-2016-3ede04cd79  View
147744 28104 CVE-2015-7576 SUSE-SU-2016:1146  View
147745 28104 CVE-2015-7576 openSUSE-SU-2016:0363  View
147746 28104 CVE-2015-7576 openSUSE-SU-2016:0372  View
147747 28104 CVE-2015-7576 RHSA-2016:0296  View
147748 28104 CVE-2015-7576 DSA-3464  View
147749 28104 CVE-2015-7576 [oss-security] 20160125 [CVE-2015-7576] Timing attack vulnerability in basic authentication in Action Controller.  View
147750 28104 CVE-2015-7576 81803  View
147751 28104 CVE-2015-7576 [ruby-security-ann] 20160125 [CVE-2015-7576] Timing attack vulnerability in basic authentication in Action Controller.  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11666 JVNDB-2015-006986 Ruby on Rails の Action Controller の Basic 認証の実装における認証を回避される脆弱性 Ruby on Rails の Action Controller の Basic 認証の実装の actionpack/lib/action_controller/metal/http_authentication.rb の http_basic_authenticate_with メソッドは、認証情報の検証に定数時間アルゴリズムを使用しないため、認証を回避される脆弱性が存在します。 CVE-2015-7576 84801 CVE-2015-7576 28104 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006986.html 2015-10-29 2016-03-15 View