Falhas do tipo CWE-208

192 resultados

Discrepância de Tempo Observável

É quando um programa leva tempos diferentes para processar entradas válidas versus inválidas, e esse tempo é observável por um atacante. Essa variação permite inferir informações sensíveis (como senhas ou tokens) através de ataques de timing, sem acesso direto aos dados.

Exemplo

Uma função que compara uma senha caractere por caractere, saindo assim que encontra um erro, leva menos tempo para senhas erradas no início do que para senhas quase corretas. Um atacante mede os tempos de resposta da API e descobre a senha testando caracteres até encontrar aquele que aumenta o tempo de processamento.

Como mitigar

Use comparação em tempo constante (funções como `hmac.compare()` em Node.js ou `secrets.compare()` em Python) que sempre levam o mesmo tempo independente da entrada. Adicione jitter (variação aleatória) no tempo de resposta e implemente rate limiting para dificultar medições precisas.

CVE-2026-15432HIGHObservable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerificationEPSS 0.2%CVE-2026-6727MEDIUMCVE-2026-6727EPSS 0.2%CVE-2024-40640LOWUsage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemacEPSS 0.2%CVE-2026-40263LOWNote Mark: Username Enumeration via Login Endpoint Timing Side-ChannelEPSS 0.2%CVE-2026-41418MEDIUM4ga Boards: User Enumeration via Timing Side-Channel in Authentication EndpointEPSS 0.2%CVE-2026-5091MEDIUMCatalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacksEPSS 0.2%CVE-2024-1543MEDIUMAES T-Table sub-cache-line leakageEPSS 0.2%CVE-2026-54736HIGHPhalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)EPSS 0.2%CVE-2026-72701MEDIUMGrav CMS before 2.0.16 Timing Attack via verifyNonceEPSS 0.2%CVE-2026-69247HIGHcryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingEPSS 0.2%CVE-2026-70437LOWJenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checkEPSS 0.2%CVE-2025-20067MEDIUMObservable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a privileged user to potentially enable informatEPSS 0.2%CVE-2025-8774LOWriscv-boom SonicBOOM L1 Data Cache timing discrepancyEPSS 0.2%CVE-2023-20572MEDIUMAn observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message autheEPSS 0.2%CVE-2023-20540LOWAn observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message autheEPSS 0.2%CVE-2020-35165MEDIUMDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable TimEPSS 0.2%CVE-2025-52457MEDIUMObservable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific EPSS 0.1%CVE-2026-41516LOWOP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding OracleEPSS 0.1%CVE-2026-41515LOWOP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recoveryEPSS 0.1%CVE-2026-41514LOWOP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recoveryEPSS 0.1%