Insecure Credential Comparison Affecting safe-compare Open this link in a new tab package, versions >=1.1.0 <1.1.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
17 Apr 2018
21 Feb 2018
Snyk Security Research Team
Introduced: 21 Feb 2018CWE-522 Open this link in a new tab
How to fix?
safe-compare to version 1.1.2 or higher.
safe-compare is a constant-time comparison algorithm to prevent timing attacks..
Affected versions of the package are vulnerable to Insecure Credential Comparison. It used the
bufferAlloc constructor incorrectly, which caused the password string to be "padded" with itself. This means that the passwords
"aaaaaaaaaaaaa" would be equal.