PT-2019-20035 · Npm · Express-Basic-Auth

Published 2019-06-06 · Updated 2019-06-06

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions express-basic-auth versions prior to 1.1.7

Description The issue concerns the use of native string comparison instead of a constant time string comparison in the express-basic-auth package. This can lead to timing attacks, which may increase the efficiency of brute-force attacks by reducing the entropy gained from longer secrets.

Recommendations Upgrade to version 1.1.7 or later.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

GHSA-C35V-QWQG-87JC

Affected Products

Express-Basic-Auth

References · 8

• https://osv.dev/vulnerability/GHSA-c35v-qwqg-87jc · Vendor Advisory
• https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263 · Note
• https://github.com/LionC/express-basic-auth · Note
• https://github.com/LionC/express-basic-auth/pull/21 · Note
• https://github.com/LionC/express-basic-auth/pull/20 · Note
• https://github.com/LionC/express-basic-auth/commit/00bb29fdd638f5cda8025d4398be97d528ce3f6f · Note
• https://npmjs.com/advisories/827 · Note
• https://snyk.io/vuln/SNYK-JS-EXPRESSBASICAUTH-174345 · Note