module: github.com/nanobox-io/golang-nanoauth
versions:
- introduced: v0.0.0-20160722212129-ac0cc4484ad4
  fixed: v0.0.0-20200131131040-063a3fb69896
description: |
  If any of the `ListenAndServe` functions are called with an empty token,
  token authentication is disabled globally for all listeners.

  Also, a minor timing side channel was present allowing attackers with
  very low latency and able to make a lot of requests to potentially
  recover the token.
published: 2021-04-14T12:00:00Z
credit: '@bouk'
symbols:
- Auth.ServerHTTP
- Auth.ListenAndServeTLS
- Auth.ListenAndServe
links:
  pr: https://github.com/nanobox-io/golang-nanoauth/pull/5
  commit: https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
cve_metadata:
  id: CVE-9999-0003
  cwe: 'CWE-305: Authentication Bypass by Primary Weakness'
  description: |
    Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between
    v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe
    is called with an empty token.