zendframework/zf2 — pull request #4570 by EvanDotPro (2013-05-31 18:17:26+00:00)
Title: Use Cypt\Utils::compareStrings() in Zend\Auth

- Replace the duplicate _secureStringCompare() methods from the Http
and Digest Zend\Authentication adapters with
Zend\Crypt\Utils::compareStrings().
- Update Zend\Authentication's composer.json to reflect the dependency
on Zend\Crypt.
- This potentially reduces the risk of a possible Information Disclosure
vulnerability, where the length of the target string could be
discovered via a timing attack. At least in the Digest adapter, there
was no security issue before this patch, as the string lengths for
both strings are _always_ 32 character MD5 hashes, thus there is no
unknown string length to disclose. I'm not 100% sure about the Http
adapter.

Potential vulnerability was responsibly disclosed by @Freeaqingme.