CVE-2024-25189: Critical severity Debian Debian Linux vulnerability
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libjwtto a version that resolves this vulnerability.Fixed in 1.10.2-1+deb12u1 - Upgrade
Upgrade
debian/libjwtto a version that resolves this vulnerability.Fixed in 1.17.0-2 - Upgrade
Upgrade
debian/libjwtto a version that resolves this vulnerability.Fixed in 1.10.2-1+deb12u1Fixed in 1.17.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25189?
CVE-2024-25189 is considered a medium severity vulnerability due to its potential for authentication bypass via a timing side channel.
How do I fix CVE-2024-25189?
To fix CVE-2024-25189, it's recommended to upgrade to a version of libjwt that eliminates the use of strcmp for authentication verification.
What software is affected by CVE-2024-25189?
CVE-2024-25189 specifically affects libjwt version 1.15.3.
What are the potential risks associated with CVE-2024-25189?
The primary risk of CVE-2024-25189 is the potential for unauthorized access due to the ability to bypass authentication.
Is CVE-2024-25189 related to side channel attacks?
Yes, CVE-2024-25189 specifically exploits a timing side channel vulnerability in the authentication mechanism.