Remote Information Disclosure in Apache CouchDB by Measuring Operation Times

CVE-2010-0009

Summary

Apache CouchDB versions 0.8.0 to 0.10.1 are susceptible to a timing attack that allows remote attackers to gain access to sensitive information. By analyzing the time taken to complete operations that verify hashes or passwords, an attacker can discern underlying data. This vulnerability emphasizes the need for improved protection mechanisms against timing-related data leaks in the affected versions.

References