Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-28615

server SCRAM-SHA should not reveal that user doesn't exist

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 5.5.0
    • 5.5.0
    • memcached
    • None
    • Untriaged
    • Unknown

    Description

      Allows dictionary attack on users list

      Attachments

        For Gerrit Dashboard: MB-28615
        # Subject Branch Project Status CR V
        92538,5 MB-28615: return generated salt if user doesn't exits in user database master ns_server Status: MERGED +2 +1
        92568,3 MB-28615 pass scramsha_fallback_salt to memcached master ns_server Status: MERGED +2 +1
        92657,7 MB-28615: SCRAM-SHA should not reveal that user doesn't exist master kv_engine Status: MERGED +2 +1

        Activity

          People

            trond Trond Norbye
            artem Artem Stemkovski
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty