Homepage
About Snyk

Insecure Credential Comparison Affecting safe-compare package, versions >=1.1.0 <1.1.2

0.0
medium

Snyk CVSS

    Attack Complexity High
    Integrity High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID npm:safe-compare:20180417
  • published 17 Apr 2018
  • disclosed 21 Feb 2018
  • credit Snyk Security Research Team
Report a new vulnerability Found a mistake?

Introduced: 21 Feb 2018

CVE NOT AVAILABLE CWE-522 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade safe-compare to version 1.1.2 or higher.

Overview

safe-compare is a constant-time comparison algorithm to prevent timing attacks..

Affected versions of the package are vulnerable to Insecure Credential Comparison. It used the bufferAlloc constructor incorrectly, which caused the password string to be "padded" with itself. This means that the passwords "a" and "aaaaaaaaaaaaa" would be equal.