3 ms·
> some guy said you needed the right HMAC key on a cookie to exploit the bug That is definitely not the intention of the article. There are other exploitable s
by FooBarWidget 14y ago
> some guy said you needed the right HMAC key on a cookie to exploit the bug
That is definitely not the intention of the article. There are other exploitable scenario and the reader is encouraged to check his code base for those instances. The article merely spends many words on what I believe would be the most scenario. The severity depends on the codebase.
- tptacek 14y agoOn this very thread you have a vulnerability researcher confirming a generic exploit of the vulnerability. Again: you're buying this article wholesale, but it's author may not know what they are talking about.