kali834x opened a new pull request, #1307: URL: https://github.com/apache/axis-axis2-java-core/pull/1307
the admin console login in AdminActions.login checked the configured username and password with String.equals, which bails out at the first differing character and short-circuits the && between the two checks, so the time to reject a guess tracks how much of a correct prefix it carried. the login action is reachable without authentication (authorizationRequired=false), so that timing is observable to a remote caller (CWE-208). this routes both comparisons through a constant-time constantTimeEquals using MessageDigest.isEqual over the utf-8 bytes and combines them with a non-short-circuiting & so the time no longer depends on where the first mismatch falls. correct credentials still authenticate and a null configured value still fails closed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
