CVE-2017-8342

Advisory

Radicale before 1.1.2 is vulnerable to bruteforce attacks when using the htpasswd authentication method. See CVE-2017-8342.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

===========================

* **Security fix**: Add a random timer to avoid timing oracles and simple
bruteforce attacks when using the htpasswd authentication method.
* Various minor fixes.

Resources

• https://pypi.org/project/radicale
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8342
• https://github.com/Kozea/Radicale/commit/190b1dd795f0c552a4992445a231da760211183b
• https://github.com/Kozea/Radicale/commit/059ba8dec1f22ccbeab837e288b3833a099cee2d
• https://github.com/Kozea/Radicale/blob/1.1.2/NEWS.rst
• https://bugs.debian.org/861514
• https://lists.debian.org/debian-lts-announce/2020/04/msg00019.html