GitHub Advisoryadvisory · npm

GHSA-h9x2-5rm7-x4gm Insecure Comparison in secure-compare

HIGH Published 2019-06-03 Modified 2020-08-31 Official page ↗
Aliases
CVE-2015-9238
Ecosystem
npm
Packages
secure-compare
Severity
High
Weaknesses
CWE-697
Reviewed
2019-06-03

Affected packages

• npm secure-compare: < 3.0.1 → fixed in 3.0.1

Description

Versions of `secure-compare` prior to 3.0.1 are affected by a vulnerability that results in the package always returning true when comparing two strings of the same length, despite differences in the contents of those strings. Recommendation Upgrade to version 3.0.1 or later.

Related

Alias · CVE (1)

  • CVE-2015-9238 secure-compare 3.0.0 and below do not actually compare two strings properly. vulnerability

Weakness · CWE (1)

  • CWE-697 Incorrect Comparison weakness

References