Description
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
References
- 39116 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=578572
- 20100331 [SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability mailing-list
- 39146 third-party-advisory
- 20100331 [SECURITY] CVE-2008-2370: Apache CouchDB Timing Attack Vulnerability mailing-list
- http://couchdb.apache.org/security.html
- 63350 vdb-entry