Insecure Credential Comparison Affecting safe-compare package, versions >=1.1.0 <1.1.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:safe-compare:20180417
- published 17 Apr 2018
- disclosed 21 Feb 2018
- credit Snyk Security Research Team
How to fix?
Upgrade safe-compare to version 1.1.2 or higher.
Overview
safe-compare is a constant-time comparison algorithm to prevent timing attacks..
Affected versions of the package are vulnerable to Insecure Credential Comparison. It used the bufferAlloc constructor incorrectly, which caused the password string to be "padded" with itself. This means that the passwords "a" and "aaaaaaaaaaaaa" would be equal.
References
CVSS Scores
version 3.1