PT-2019-20035 · Npm · Express-Basic-Auth

Publicado 2019-06-06 · Atualizado 2019-06-06

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions express-basic-auth versions prior to 1.1.7

Description The issue concerns the use of native string comparison instead of a constant time string comparison in the express-basic-auth package. This can lead to timing attacks, which may increase the efficiency of brute-force attacks by reducing the entropy gained from longer secrets.

Recommendations Upgrade to version 1.1.7 or later.

Correção

Enumeração de Fraquezas

CWE-208

Identificadores relacionados

GHSA-C35V-QWQG-87JC

Produtos afetados

Express-Basic-Auth

Referências · 8

• https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263 · Nota
• https://github.com/LionC/express-basic-auth · Nota
• https://github.com/LionC/express-basic-auth/pull/21 · Nota
• https://github.com/LionC/express-basic-auth/pull/20 · Nota
• https://github.com/LionC/express-basic-auth/commit/00bb29fdd638f5cda8025d4398be97d528ce3f6f · Nota
• https://npmjs.com/advisories/827 · Nota
• https://snyk.io/vuln/SNYK-JS-EXPRESSBASICAUTH-174345 · Nota
• https://osv.dev/vulnerability/GHSA-c35v-qwqg-87jc · Aviso do Fabricante