[dev.icinga.com #13993] Hash API password and use time constant password compares

[icinga-migration]

This issue has been migrated from Redmine: https://dev.icinga.com/issues/13993

Created by jflach on 2017-01-13 08:55:05 +00:00

Assignee: jflach
Status: Assigned
Target Version: (none)
Last Update: 2017-01-13 08:55:05 +00:00 (in Redmine)

Backport?: Not yet backported
Include in Changelog: 1

---

API user credentials are compared using the != operator on icinga::String which maps directly to the != operator of std::string which is not guaranteed to be constant time and thus is likely vulnerable to timing attacks.

An alternative to making the comparision time constant would be always save the API passwords hashed.