Apache HTTP Server Digest Authentication Bypass Vulnerability Timing Attack

A timing attack vulnerability has been identified in the mod_auth_digest module of Apache HTTP Server versions through 2.4.66. This vulnerability allows a remote attacker to bypass Digest authentication. The issue arises from the way authentication timing is handled, creating a potential window for exploitation.

Impact

Exploitation of this vulnerability allows for bypassing Digest authentication, potentially leading to unauthorized access.

Remediation

Users are advised to upgrade to Apache HTTP Server version 2.4.67, which addresses this vulnerability.