0 releases 20 tags

RSS feed

• imports/c10s/memcached-1.6.23-8.el10 fb919d63be

  Compare

  Fix CVE-2026-47783: SASL timing side-channel in memcached

  Ghost released this 2026-07-14 13:28:26 +00:00 | -216 commits to c8 since this release

  Backport upstream commit d13f282b4bce to fix CVE-2026-47783,
  a timing side-channel vulnerability in SASL password database
  authentication. The patch uses constant-time safe_memcmp() for
  username and password comparisons, zero-fills the buffer before
  each fgets call, and removes the early break to ensure the
  entire password file is always scanned, eliminating measurable
  timing differences between valid and invalid usernames.

  CVE: CVE-2026-47783
  Upstream patches:

  • github.com/memcached/memcached@d13f282b4b.patch
    Resolves: RHEL-179085

  This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

  Assisted-by: Ymir

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download