CVE-2017-8342: Radicale Authentication Timing Oracle Vulnerability
Summary
CVE-2017-8342: Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. Affects radicale across 3 version ranges.
< 1.1.2
< 059ba8dec1f22ccbeab837e288b3833a099cee2d
< 190b1dd795f0c552a4992445a231da760211183b
Fixed in 190b1dd795f0c552a4992445a231da760211183b. How to fix ↓
Also tracked for
- radicale · Debian:11
The same CVE-2017-8342 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Radicale is an open-source CalDAV and CardDAV server written in Python. It provides a lightweight solution for managing calendar and contact data. The htpasswd authentication method is supported by Radicale, allowing users to authenticate with a username and password. However, versions prior to 1.1.2 and 2.x before 2.0.0rc2 are vulnerable to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
Vulnerability Detail
The vulnerability in Radicale arises from the htpasswd authentication method. Attackers can exploit timing oracles to determine the validity of usernames and passwords. By measuring the time it takes for a response, an attacker can infer whether the authentication attempt was successful or not. This information can be used to launch brute-force attacks and gain unauthorized access to the server. The vulnerability poses a risk to the confidentiality and integrity of the data stored in Radicale.
How To Fix
Latest published version: 3.8.3 as of 23 Oct 2026
pip install --upgrade "radicale==3.8.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
190b1dd795f0c552a4992445a231da760211183b
This is the first release that contains the fix.
pip install --upgrade "radicale==190b1dd795f0c552a4992445a231da760211183b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider using alternative authentication methods or implementing additional security measures, such as rate limiting or account lockouts, to mitigate the risk of brute-force attacks.
Conclusion
The Radicale Authentication Timing Oracle vulnerability (CVE-2017-8342) exposes the server to timing oracles and brute-force attacks when using the htpasswd authentication method. To address this vulnerability, it is crucial to update Radicale to the recommended versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for radicale →
FAQ
Radicale is an open-source CalDAV and CardDAV server written in Python. It allows users to manage calendar and contact data.
The htpasswd authentication method is a common method used to password protect web resources. It involves storing usernames and hashed passwords in a file, typically named .htpasswd.
The timing oracle vulnerability in Radicale allows attackers to determine the validity of usernames and passwords by measuring the response time. By analyzing the timing differences, an attacker can launch brute-force attacks to guess valid credentials.
This vulnerability can lead to unauthorized access to Radicale servers, compromising the confidentiality and integrity of calendar and contact data. Attackers can potentially view, modify, or delete sensitive information.
To mitigate the risk, it is recommended to update Radicale to the latest stable release (1.1.2 or later for the 1.x branch, or 2.0.0rc2 or later for the 2.x branch). Additionally, consider implementing additional security measures such as rate limiting or account lockouts.
References
Related vulnerabilities
Recent vulnerabilities recorded for radicale.
