CVE-2024-30257

描述

### Summary 源码中密码校验处使用 != 符号，而不是`hmac.Equal`，这可能导致产生计时攻击漏洞，从而爆破密码。 建议使用 `hmac.Equal` 比对密码。 Translation: The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords. ### Details https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26 ### Impact 该产品的所有使用者。 Translation: All users of this product.

受影響套件(2)

• Go/github.com/1Panel-dev/1Panelfrom 0, < 1.10.3
• Go/github.com/1Panel-dev/1Panelfrom 0

CVSS 分數

參考連結(4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-30257
• PATCHhttps://github.com/1Panel-dev/1Panel
• WEBhttps://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26
• WEBhttps://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8f