Insecure Comparison

Module: secure-compare

Published: October 24th, 2015

Reported by: Joshua Dague

CVE-NONE

CWE-

Vulnerable: <=3.0.0
Patched: >3.0.0

Overview

secure-compare 3.0.0 and below do not actually compare two strings properly.

compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Remediation

Upgrade to secure-compare 3.0.1 or greater.

References

Sign up FREE for
nsp Continuous Security

Free for open source and the first private repo,
then just $1/mo per private repo