Read the docs
TI-2022-26540 Aliases GHSA-xfqg-p48g-hh94

Login timing attack in ezsystems/ezpublish-kernel

Priority LOW 38CWE-208Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-208.

Summary

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.

Why it matters now

Fix Fixed ezsystems/ezpublish-kernel (Packagist): 7.5.29

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ezsystems/ezpublish-kernel (Packagist)7.5.0 to before 7.5.297.5.29Patch availableGHSA-xfqg-p48g-hh94
  • ezsystems/ezpublish-kernel (Packagist) Vendor— Affected 7.5.0 to before 7.5.29 Fixed in 7.5.29 Patch available GHSA-xfqg-p48g-hh94

Remediation

  • Fix · GHSA-xfqg-p48g-hh94 ezsystems/ezpublish-kernel (Packagist) Fixed in 7.5.29 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-xfqg-p48g-hh94

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences