websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.
References
| Link | Resource |
|---|---|
| https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4ca | Mailing List Third Party Advisory |
| https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=true | Product Third Party Advisory |
Configurations
History
12 Aug 2022, 15:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-331 | |
| First Time |
Embedthis
Embedthis goahead |
|
| References | (MISC) https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=true - Product, Third Party Advisory | |
| References | (MISC) https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4ca - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:embedthis:goahead:2.1.8:*:*:*:*:*:*:* |
08 Aug 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-08 19:15
Updated : 2023-12-10 14:35
NVD link : CVE-2021-41615
Mitre link : CVE-2021-41615
CVE.ORG link : CVE-2021-41615
JSON object : View
Products Affected
embedthis
- goahead
CWE
CWE-331
Insufficient Entropy