CVE-2024-22893: PYSEC-2024-290 - OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers

CVE-2024-22893 · Severity: low · CVSS 3.1 · Published 2024-09-25

Technologies: openslides (PyPI). Vendors: PyPI.

Executive brief

OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.

Affected products

PyPI openslides

Related threats

PYSEC-2024-99 - OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.
PYSEC-2020-72 - OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. O