CVE-2020-11037

描述

In Wagtail before versions 2.7.2 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. This is understood to be feasible on a local network, but not on the public internet. Privacy settings that restrict access to pages/documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability. This has been patched in 2.7.3, 2.8.2, 2.9.

如何修補 CVE-2020-11037

要修補 CVE-2020-11037,請將受影響套件升級到下列已修補版本。

• —升級至 2.7.3 或更新版本

CVE-2020-11037 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 2.7.3

CVSS 分數

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-11037
• PATCHgithub.com/wagtail/wagtail
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2020-153.yaml
• WEBgithub.com/wagtail/wagtail/commit/3c030490ed575bb9cd01dfb3a890477dcaeb2edf