module: github.com/nanobox-io/golang-nanoauth
versions:
  - introduced: v0.0.0-20160722212129-ac0cc4484ad4
    fixed: v0.0.0-20200131131040-063a3fb69896
description: |
    If any of the ListenAndServe functions are called with an empty token,
    token authentication is disabled globally for all listeners.

    Also, a minor timing side channel was present allowing attackers with
    very low latency and able to make a lot of requests to potentially
    recover the token.
credit: '@bouk'
symbols:
  - Auth.ServerHTTP
  - Auth.ListenAndServeTLS
  - Auth.ListenAndServe
derived_symbols:
  - ListenAndServe
  - ListenAndServeTLS
links:
    pr: https://github.com/nanobox-io/golang-nanoauth/pull/5
    commit: https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
cve_metadata:
    id: CVE-9999-0003
    cwe: 'CWE-305: Authentication Bypass by Primary Weakness'
    description: |
        Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between
        v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe
        is called with an empty token.