From b5535c1d0bfbec6b48e40387ff94532eb10106b0 Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Tue, 28 Apr 2026 01:51:01 +0300 Subject: [PATCH] [PATCH 2/2] doveadm: Avoid leaking doveadm_password or doveadm_api_key lengths Gbp-Pq: Name 0002-doveadm-Avoid-leaking-doveadm_password-or-doveadm_ap.patch --- src/doveadm/client-connection-http.c | 4 ++-- src/doveadm/client-connection-tcp.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/doveadm/client-connection-http.c b/src/doveadm/client-connection-http.c index dfbc352..f083ac6 100644 --- a/src/doveadm/client-connection-http.c +++ b/src/doveadm/client-connection-http.c @@ -973,7 +973,7 @@ doveadm_http_server_auth_basic(struct client_request_http *req, b64_value = t_base64_encode_str(0, UINT_MAX, value); if (creds->data != NULL && - str_equals_timing_almost_safe(str_c(b64_value), creds->data)) + str_equals_hash_timing_safe(str_c(b64_value), creds->data)) return TRUE; e_error(conn->conn.event, @@ -999,7 +999,7 @@ doveadm_http_server_auth_api_key(struct client_request_http *req, b64_value = t_base64_encode_str(0, UINT_MAX, set->doveadm_api_key); if (creds->data != NULL && - str_equals_timing_almost_safe(creds->data, str_c(b64_value))) + str_equals_hash_timing_safe(creds->data, str_c(b64_value))) return TRUE; e_error(conn->conn.event, diff --git a/src/doveadm/client-connection-tcp.c b/src/doveadm/client-connection-tcp.c index cb16f72..b374028 100644 --- a/src/doveadm/client-connection-tcp.c +++ b/src/doveadm/client-connection-tcp.c @@ -400,7 +400,7 @@ client_connection_tcp_authenticate(struct client_connection_tcp *conn) return -1; } pass = t_strndup(data + 9, size - 9); - if (!str_equals_timing_almost_safe(pass, set->doveadm_password)) { + if (!str_equals_hash_timing_safe(pass, set->doveadm_password)) { e_error(conn->conn.event, "doveadm client authenticated with wrong password"); return -1; -- 2.39.5