ExternalVendorCode/tahoe-lafs
1
0
Fork 0
mirror of https://github.com/tahoe-lafs/tahoe-lafs.git synced 2025-04-10 04:09:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

news fragment

Browse Source
This commit is contained in:
Jean-Paul Calderone 2021-10-25 20:47:35 -04:00
parent aa6360f08e
commit 0b4e6754a3
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
newsfragments/3827.security Normal file
View File

@ -0,0 +1,4 @@
The SFTP server no longer accepts password-based credentials for authentication.
Public/private key-based credentials are now the only supported authentication type.
This removes plaintext password storage from the SFTP credentials file.
It also removes a possible timing side-channel vulnerability which might have allowed attackers to discover an account's plaintext password.