Timing Attack Vulnerability in Redmine by Jean-Philippe Lang

CVE-2021-31866

What is CVE-2021-31866?

Redmine versions prior to 4.0.9 and 4.1.x before 4.1.3 are susceptible to a timing attack that allows an external attacker to infer sensitive internal authentication keys based on the timing differences observed in string comparison operations executed within SysController and MailHandlerController. This vulnerability highlights weaknesses in the application's handling of cryptographic operations, which could lead to unauthorized access or further exploitation.

References