Sébastien Helleu 30230498b2 relay: fix timing attack on password authentication (GHSA-vhv8-g2r9-cwcc) ...

The relay authentication used non-constant-time comparisons (strcasecmp,
strcmp) to verify password hashes and plaintext passwords, allowing an
attacker to derive the expected hash byte-by-byte from response timing
and then authenticate without knowing the password.

- SHA/PBKDF2 hex hash comparisons: normalize the client-supplied hash to
  uppercase and compare in constant time over the fixed expected length.
- Plaintext password comparison: HMAC-SHA256 both passwords with a fresh
  per-call random key and compare the fixed-size MACs in constant time,
  hiding both per-byte timing and the password length.

Add string_memcmp_constant_time helper in core, exposed via the plugin
API. Bump WEECHAT_PLUGIN_API_VERSION accordingly.

2026-05-31 09:11:53 +02:00

..

hook

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-arraylist.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-calc.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-command.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-config-file.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-crypto.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-dir.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-eval.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-hashtable.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-hdata.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-hook.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-infolist.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-input.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-list.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-network.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-secure.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-signal.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-string.cpp

relay: fix timing attack on password authentication (GHSA-vhv8-g2r9-cwcc)

2026-05-31 09:11:53 +02:00

test-core-sys.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-url.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-utf8.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00

test-core-util.cpp

core, plugins: fix typos in comments on functions, use imperative

2026-03-23 20:45:36 +01:00