CVE-2017-8342: Race Condition

Q: Which deployments are exposed to this issue?

Deployments using Radicale with the htpasswd authentication method are affected if they run a version before 1.1.2, or a 2.x version before 2.0.0rc2.

Q: What does an attacker need to exploit it?

The vulnerability can be exploited remotely without authentication or user interaction, but the attack complexity is high. It enables timing-oracle attacks and simple brute-force attempts against htpasswd authentication.

Q: What should be done to remediate the issue?

Apply the available patch by upgrading to Radicale 1.1.2 or later, or for the 2.x line, to 2.0.0rc2 or later.

Published Apr 30, 2017

Updated

Radicale before 1.1.2 and 2.0.0rc1 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.

Other sources

Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.

Affected Software

4 affected componentsFixes available

pip/Radicale=2.0.0rc1

2.0.0rc2

pip/Radicale<1.1.2

1.1.2

Radicale Radicale<=1.1.1

Radicale Radicale=2.0.0-rc1

Remediation

Event History

Apr 30, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

May 13, 2022

Advisory Published

via GitHub·01:27 AM

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Radicale with the htpasswd authentication method are affected if they run a version before 1.1.2, or a 2.x version before 2.0.0rc2.

What does an attacker need to exploit it?

The vulnerability can be exploited remotely without authentication or user interaction, but the attack complexity is high. It enables timing-oracle attacks and simple brute-force attempts against htpasswd authentication.

What should be done to remediate the issue?

Apply the available patch by upgrading to Radicale 1.1.2 or later, or for the 2.x line, to 2.0.0rc2 or later.

CVE-2017-8342: Race Condition

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should be done to remediate the issue?