Task #83329: Use hash_equals for timing-safe comparison of hash-values - TYPO3 Core - TYPO3 Forge

Custom queries

Accessibility
Easy tasks
Forge Triage
JavaScript issues
JavaScript Issues (w/o Epics/Stories)
My open issues
No feedback within 90 days
Open Bugs
Open issues of 10
Recently modified
Regressions
Stabilization Issues
Usability or UX

Watchers (1)

Stefan Neufeind

Actions

Copy link

Task #83329

closed

Use hash_equals for timing-safe comparison of hash-values

Added by Stefan Neufeind almost 7 years ago. Updated about 6 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Helmut Hummel

Category:

Security

Target version:

Start date:

2017-12-14

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

PHP Version:

Tags:

Complexity:

Sprint Focus:

Description

To prevent timing-attacks on hash-comparions it is advised to use hash_equals (https://secure.php.net/hash_equals).

History
Notes
Property changes
Associated revisions

Actions

Copy link

Updated by Gerrit Code Review almost 7 years ago

Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55074

Actions

Copy link

Updated by Mathias Brodala almost 7 years ago

Also see https://paragonie.com/blog/2015/11/preventing-timing-attacks-on-string-comparison-with-double-hmac-strategy for a bit more background.

Actions

Copy link

Updated by Gerrit Code Review almost 7 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55074

Actions

Copy link

Updated by Gerrit Code Review almost 7 years ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55074

Actions

Copy link

Updated by Stephan Großberndt almost 7 years ago

Subject changed from Use hash_equals for timing-safe comparion of hash-values to Use hash_equals for timing-safe comparison of hash-values

Actions

Copy link

Updated by Gerrit Code Review almost 7 years ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55074

Actions

Copy link

Updated by Stefan Neufeind almost 7 years ago

Status changed from Under Review to Resolved
% Done changed from 0 to 100

Applied in changeset cc9b6676fb9c8f6f9bf8a94480fa569af15fabd6.

Actions

Copy link

Updated by Gerrit Code Review almost 7 years ago

Status changed from Resolved to Under Review

Patch set 1 for branch TYPO3_8-7 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/55098

Actions

Copy link