PT-2018-4551 · Unknown · Secure-Compare

Daguej · Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2015-9238

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions secure-compare versions prior to 3.0.1

Description The issue arises from the secure-compare function comparing the first argument with itself instead of comparing two different strings. This results in the function always returning true when comparing two strings of the same length, regardless of their actual contents.

Recommendations For versions prior to 3.0.1, upgrade to version 3.0.1 or later.

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

CWE-697

Identificadores relacionados

CVE-2015-9238

GHSA-H9X2-5RM7-X4GM

Produtos afetados

Secure-Compare

Referências · 6

• https://github.com/vdemedes/secure-compare/pull/1 · Nota
• https://github.com/vadimdemedes/secure-compare/commit/dd1ff1ac0122de7e0af4f00c61ed73261062394a · Nota
• https://nodesecurity.io/advisories/50 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-9238 · Nota de Segurança
• https://npmjs.com/advisories/50 · Nota
• https://osv.dev/vulnerability/GHSA-h9x2-5rm7-x4gm · Aviso do Fabricante