PT-2022-28176 · Ibexa · Ibexa Dxp

Published 2022-06-02 · Updated 2022-06-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Ibexa DXP (affected versions not specified)

Description The issue concerns the privacy of user accounts due to insufficient protection against timing attacks. The current implementation of random execution time is not effective in all situations, allowing potential discovery of account existence without knowing the password. The problem is addressed by replacing the random execution time with constant time functionality.

Recommendations For Ibexa DXP, configure the new security.yml parameter 'ibexa.security.authentication.constant auth time' to enable constant time functionality for authentication. If a warning is logged indicating that the constant time is exceeded, increase the setting as needed to prevent such warnings.

Weakness Enumeration

CWE-208

Related Identifiers

GHSA-2X4V-G8CX-JXRQ

Affected Products

Ibexa Dxp

References · 4

• https://osv.dev/vulnerability/GHSA-2x4v-g8cx-jxrq · Vendor Advisory
• https://github.com/ibexa/core · Note
• https://github.com/ibexa/core/security/advisories/GHSA-2x4v-g8cx-jxrq · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce · Note