Snyk identified bug in JGDMS/jgdms-platform/src/main/java/org/apache/river/api/io/X500PrincipalSerializer.java

pfirmstone / JGDMS

Infrastructure for providing secured micro services, that are dynamically discoverable and searchable over ipv6 networks

https://pfirmstone.github.io/JGDMS/

Apache License 2.0

14 stars 4 forks source link

Snyk identified bug in JGDMS/jgdms-platform/src/main/java/org/apache/river/api/io/X500PrincipalSerializer.java #144

Closed pfirmstone closed 2 years ago

pfirmstone commented 2 years ago

Describe the bug An attacker can guess the secret value of [getEncoded]() because it is compared using [java.util.Arrays.equals](), which is vulnerable to timing attacks. Use java.security.MessageDigest.isEqual to compare values securely.