OpenStack Compute (nova)

  1. Bug #1325128
  2. Comment #3

Comment 3 for bug 1325128

Revision history for this message
Alex Gaynor (alex-gaynor) wrote : Re: nova metadata does not use a constant time compare for validating an HMAC token

This particularly one hasn't been demonstrated to be exploitable, however this precise pattern has: http://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar-library/

If someone more familiar with this bit of code and the implications can weigh in and says it's fine, I'm happy to just send up a CR for this.