diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-03-31 22:51:28 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-04-01 00:42:04 -0400 |
| commit | 9a69c24150965e54322ed9616638d4f1939b1289 (patch) | |
| tree | a28e0c4d406c63356d95460d77930a6a700c229f /ReleaseNotes | |
| parent | 9740f067c4bed47beb63483be4f4636167a04019 (diff) | |
| download | tor-9a69c24150965e54322ed9616638d4f1939b1289.tar tor-9a69c24150965e54322ed9616638d4f1939b1289.tar.gz | |
Do not use strcmp() to compare an http authenticator to its expected value
This fixes a side-channel attack on the (fortunately unused!)
BridgePassword option for bridge authorities. Fix for bug 5543;
bugfix on 0.2.0.14-alpha.
Diffstat (limited to 'ReleaseNotes')
0 files changed, 0 insertions, 0 deletions