Sébastien Helleu 1ca2a00255 core: fix timing attack on TOTP validation (GHSA-vhv8-g2r9-cwcc) ...

weecrypto_totp_validate compared the generated and client-supplied OTPs
with strcmp and broke out of the time-window loop on the first match.
Both choices leaked information via response timing: strcmp leaked the
expected OTP digit-by-digit (shrinking the brute-force search from
~10^digits to a handful of guesses within the 30-second window), and
the early break leaked which window offset matched.

Compare in constant time with string_memcmp_constant_time and always
iterate the full window, OR-ing the result into otp_ok without an
early exit.

This affects both relay protocols (which call totp_validate via the
public info hook) and any other caller of the info hook.

2026-05-31 09:14:24 +02:00

..

core

core: fix timing attack on TOTP validation (GHSA-vhv8-g2r9-cwcc)

2026-05-31 09:14:24 +02:00

gui

core: fix option weechat.look.color_real_white not applied when color is "white" on 16+ colors terminals (issue #1742)

2026-05-23 13:41:40 +02:00

plugins

relay/irc: fix timing attack on PASS command (GHSA-vhv8-g2r9-cwcc)

2026-05-31 09:12:09 +02:00

CMakeLists.txt

core: update copyright dates

2026-03-08 10:37:15 +01:00