Bug 1017982 (CVE-2013-4434)

Summary:	CVE-2013-4434 dropbear: user disclosure via authentication failure delays
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	buytenh, i, itamar, ratulg
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dropbear 2013.59	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-11-04 08:42:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1017985, 1017986
Bug Blocks:

Description Vincent Danen 2013-10-10 22:05:42 UTC

It was reported [1] that versions of dropbear prior to 2013.59 suffered from a flaw where it would disclose the existence of valid users due to inconsistent delays on authentication failures.

This has been fixed in git [2].  A CVE assignment is pending [3].

[1] https://matt.ucc.asn.au/dropbear/CHANGES
[2] https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a
[3] http://www.openwall.com/lists/oss-security/2013/10/10/15

Comment 1 Vincent Danen 2013-10-10 22:10:34 UTC

Created dropbear tracking bugs for this issue:

Affects: fedora-all [bug 1017985]
Affects: epel-all [bug 1017986]

Comment 2 Christopher Meng 2013-11-03 12:17:07 UTC

Can I close it now?

Comment 3 Tomas Hoger 2013-11-04 08:42:28 UTC

Closing, thank you!