CVE-2017-12872

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/06/msg00017.htmlMailing List, Third Party Advisory
https://simplesamlphp.org/security/201703-01Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/06/msg00017.htmlMailing List, Third Party Advisory
https://simplesamlphp.org/security/201703-01Patch, Vendor Advisory

Timeline

Published: Sep 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-128739.8SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified oth CVE-2017-128747.5The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signat CVE-2017-128756.5The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a craft CVE-2017-128766.5Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted fil CVE-2017-128776.5Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial CVE-2017-128795.4Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monitor before 17.3.33.2654 CVE-2017-128818.8Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication CVE-2017-128825.4Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary Jav CVE-2017-128839.1Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attacker CVE-2017-128847.5OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.CVE-2017-128856.1OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).CVE-2017-12898.2IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could e