CVE-2012-5507

Advisory

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5507
• http://www.openwall.com/lists/oss-security/2012/11/10/1
• https://plone.org/products/plone/security/advisories/20121106/23
• https://bugs.launchpad.net/zope2/+bug/1071067
• https://plone.org/products/plone-hotfix/releases/20121106
• https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt