CVE-2024-25189: Critical severity Debian Debian Linux vulnerability
Published Feb 8, 2024
·Updated
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Affected Software
2 affected components
Debian Debian Linux=10.0
libjwt LibJWT=1.15.3
Event History
Feb 8, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-25189?
CVE-2024-25189 is considered a medium severity vulnerability due to its potential for authentication bypass via a timing side channel.
2
How do I fix CVE-2024-25189?
To fix CVE-2024-25189, it's recommended to upgrade to a version of libjwt that eliminates the use of strcmp for authentication verification.
3
What software is affected by CVE-2024-25189?
CVE-2024-25189 specifically affects libjwt version 1.15.3.
4
What are the potential risks associated with CVE-2024-25189?
The primary risk of CVE-2024-25189 is the potential for unauthorized access due to the ability to bypass authentication.
5
Is CVE-2024-25189 related to side channel attacks?
Yes, CVE-2024-25189 specifically exploits a timing side channel vulnerability in the authentication mechanism.