{"id":"CVE-2024-30257","aliases":["GHSA-6m9h-2pr2-9j8f","GO-2024-2734"],"url":"https://o3.security/vulnerability/CVE-2024-30257","summary":"1Panel's password verification is suspected to have a timing attack vulnerability","details":"### Summary\n源码中密码校验处使用 != 符号，而不是`hmac.Equal`，这可能导致产生计时攻击漏洞，从而爆破密码。  \n建议使用 `hmac.Equal` 比对密码。\n\nTranslation:\n\nThe source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.\n\n### Details\nhttps://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26\n\n### Impact\n该产品的所有使用者。\n\nTranslation:\n\nAll users of this product.","published":"2024-04-18T14:56:56.270Z","modified":"2026-08-12T03:51:15.081983681Z","cvss":{"score":3.9,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel","fixedVersion":"1.10.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26"},{"type":"ADVISORY","url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30257.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30257"},{"type":"PACKAGE","url":"https://github.com/1Panel-dev/1Panel"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:15.081983681Z"}}