CVE-2015-10004 - Vulnerability Details - OpenCVE

ReportizFlow

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Json Web Token Project	Json Web Token

Configuration 1 [-]

cpe:2.3:a:json_web_token_project:json_web_token:-:*:*:*:*:go:*:*

No data.

References

Link	Providers
https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654
https://github.com/robbert229/jwt/issues/12
https://pkg.go.dev/vuln/GO-2020-0023

History

No history.

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2022-12-27T21:13:11.967Z

Updated: 2024-08-06T08:58:24.640Z

Reserved: 2022-07-29T16:09:30.296Z

Link: CVE-2015-10004

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-12-27T22:15:10.947

Modified: 2024-11-21T02:24:09.343

Link: CVE-2015-10004

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:json_web_token_project:json_web_token:-:*:*:*:*:go:*:*", "matchCriteriaId": "7D52A34D-2AF5-4373-8B69-4A4AC8A7711D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC."}, {"lang": "es", "value": "Los m\u00e9todos de validaci\u00f3n de tokens son susceptibles a un canal lateral de temporizaci\u00f3n durante la comparaci\u00f3n HMAC. Con una cantidad suficientemente grande de solicitudes a trav\u00e9s de una conexi\u00f3n de baja latencia, un atacante puede usar esto para determinar el HMAC esperado."}], "id": "CVE-2015-10004", "lastModified": "2024-11-21T02:24:09.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-12-27T22:15:10.947", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/robbert229/jwt/issues/12"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2020-0023"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/robbert229/jwt/issues/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://pkg.go.dev/vuln/GO-2020-0023"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "[email protected]", "type": "Primary"}]}