3 ms·
Bouncy Castle crypto authentication bypass vulnerability revealed
- octoberfranklin 6y agoWow, this wins the facepalm award: "The code checks for an index of characters from 0 to 59 inclusive, rather than checking that characters at positions from 0 to 59 match," reads the report published by Synopsys." for (int i = 0; i != sLength; i++) { isEqual &= (bcryptString.indexOf(i) == newBcryptString.indexOf(i)); } In other words, the indexOf() should be at().