express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison
Low severity
GitHub Reviewed
Published
Jun 6, 2019
to the GitHub Advisory Database
•
Updated Jan 11, 2023
Description
Reviewed
Jun 6, 2019
Published to the GitHub Advisory Database
Jun 6, 2019
Last updated
Jan 11, 2023
Versions of
express-basic-authprior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.Recommendation
Upgrade to version 1.1.7 or later.
References