Weakness (CWE)
CWE-1254: Incorrect Comparison Logic Granularity
The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.
More detail
Comparison logic is used to compare a variety of objects including passwords, Message
Authentication Codes (MACs), and responses to verification challenges. When comparison logic is
implemented at a finer granularity (e.g., byte-by-byte comparison) and breaks in the case of a
comparison failure, an attacker can exploit this implementation to identify when exactly
the failure occurred. With multiple attempts, the attacker may be able to guesses the correct
password/response to challenge and elevate their privileges.
How to prevent it (1 mitigation)
-
Implementation
The hardware designer should ensure that comparison logic is implemented so as to compare in one operation instead in smaller chunks.
Source: MITRE CWE-1254
2 results · Clear filters · Feed
-
Medium 4.8
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same …
-
Medium 6.5
GoCD API authentication of user access tokens subject to timing attack during comparison
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 (inclusive) are subject to a timing attack in validation of access tokens d…