CVE-2010-0009
Apache CouchDB Timing Attack
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
Apache CouchDB v0.8.0 hasta v0.10.1 permite a atacantes remotos conseguir información sensible midiedfo el tiempo de completar las operaciones que verifican (1) hashes o (2) passwords.
Apache CouchDB versions prior to version 0.11.0 are vulnerable to timing attacks, also known as side-channel information leakage, due to using simple break-on-inequality string comparisons when verifying hashes and passwords.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-12-14 CVE Reserved
- 2010-04-01 CVE Published
- 2024-08-07 CVE Updated
- 2025-07-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2010-03/0267.html | Mailing List | |
| http://www.osvdb.org/63350 | Vdb Entry | |
| http://www.securityfocus.com/archive/1/510427/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/39116 | Vdb Entry | |
| https://bugzilla.redhat.com/show_bug.cgi?id=578572 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://couchdb.apache.org/security.html | 2018-10-10 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/39146 | 2018-10-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Couchdb Search vendor "Apache" for product "Couchdb" | 0.8.0 Search vendor "Apache" for product "Couchdb" and version "0.8.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Couchdb Search vendor "Apache" for product "Couchdb" | 0.8.1 Search vendor "Apache" for product "Couchdb" and version "0.8.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Couchdb Search vendor "Apache" for product "Couchdb" | 0.9.0 Search vendor "Apache" for product "Couchdb" and version "0.9.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Couchdb Search vendor "Apache" for product "Couchdb" | 0.9.1 Search vendor "Apache" for product "Couchdb" and version "0.9.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Couchdb Search vendor "Apache" for product "Couchdb" | 0.9.2 Search vendor "Apache" for product "Couchdb" and version "0.9.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Couchdb Search vendor "Apache" for product "Couchdb" | 0.10.0 Search vendor "Apache" for product "Couchdb" and version "0.10.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Couchdb Search vendor "Apache" for product "Couchdb" | 0.10.1 Search vendor "Apache" for product "Couchdb" and version "0.10.1" | - |
Affected
| ||||||