Timing Attack The advisory has been revoked - it doesn't affect any version of package bcrypt  (opens in a new tab)

This was deemed not a vulnerability.

bcrypt is an A library to help you hash passwords.

Affected versions of this package are vulnerable to Timing Attack. The CompareStrings function is not timing safe. Comparisons with a different length of string have very different execution times. Even with the same length of string, comparisons of matching strings run faster than comparisons of different strings. This is due to the use of a comparison statement (if) when evaluating strings, which results in different outcomes dependent on the evaluation.

NAN_INLINE bool CompareStrings(const char* s1, const char* s2) {
    bool eq = true;
    int s1_len = strlen(s1);
    int s2_len = strlen(s2);

// UNSAFE: This executes different instructions for a different length of string
if (s1_len != s2_len) {
    eq = false;
}

const int max_len = (s2_len < s1_len) ? s1_len : s2_len;

for (int i = 0; i < max_len; ++i) {
  // UNSAFE: s1 and s2 are only referenced if the index is valid (different instructions executed for different length of string)
  if (s1_len >= i && s2_len >= i && s1[i] != s2[i]) {
    // UNSAFE: This instruction is only executed if the bytes are different
    eq = false;
  }
}

return eq;

}

• GitHub Issue
• Timing Comparison PoC