Insecure Credential Comparison Affecting safe-compare Open this link in a new tab package, versions >=1.1.0 <1.1.2


0.0
medium
  • Attack Complexity

    High

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    npm:safe-compare:20180417

  • published

    17 Apr 2018

  • disclosed

    21 Feb 2018

  • credit

    Snyk Security Research Team

Introduced: 21 Feb 2018

CWE-522 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade safe-compare to version 1.1.2 or higher.

Overview

safe-compare is a constant-time comparison algorithm to prevent timing attacks..

Affected versions of the package are vulnerable to Insecure Credential Comparison. It used the bufferAlloc constructor incorrectly, which caused the password string to be "padded" with itself. This means that the passwords "a" and "aaaaaaaaaaaaa" would be equal.