mdickopp

use bevy_ecs::component::Component;

#[derive(Component)]
struct C0000;

#[derive(Component)]
struct C0001;

#[derive(Component)]
struct C0002;

mdickopp

CVE-2024-22893

Password validation vulnerable to timing attacks in OpenSlides 4.0.15

OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.

This vulnerability has been fixed in OpenSlides 4.0.16.

mdickopp

CVE-2024-22892

Weak password hashing in OpenSlides 4.0.15

OpenSlides 4.0.15 hashes passwords by applying a single round of SHA-512 to the cleartext password and the salt. Attackers who have obtained the hashed passwords can therefore calculate the cleartext passwords within a very short amount of time, using massively-parallel computing (such as cloud computing) and GPU, ASIC, or FPGA hardware.