Sébastien Helleu e540d7a2cf relay/irc: fix timing attack on PASS command (GHSA-vhv8-g2r9-cwcc) ...

The IRC relay protocol's PASS handler compared the server password with
the client-supplied value using strcmp, leaking the password byte-by-byte
via response timing. This is the same class of bug fixed for the api and
weechat protocols, on a separate code path that did not go through
relay_auth_check_password_plain.

Extract the HMAC-then-constant-time-compare logic from
relay_auth_check_password_plain into relay_auth_password_equals, then
use it in both the plain-auth wrapper and the IRC PASS handler.

2026-05-31 09:16:36 +02:00

..

fuzz

core: update copyright dates

2026-03-08 10:37:15 +01:00

unit

relay/irc: fix timing attack on PASS command (GHSA-vhv8-g2r9-cwcc)

2026-05-31 09:16:36 +02:00

CMakeLists.txt

core: update copyright dates

2026-03-08 10:37:15 +01:00