GMS-2019-23: Timing Attack in express-basic-auth
(updated )
Versions of express-basic-auth are vulnerable to Timing Attacks. The package uses nating string comparison instead of a constant time string compare which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.
References
- github.com/LionC/express-basic-auth/commit/00bb29fdd638f5cda8025d4398be97d528ce3f6f
- github.com/LionC/express-basic-auth/pull/20
- github.com/LionC/express-basic-auth/pull/21
- github.com/advisories/GHSA-c35v-qwqg-87jc
- github.com/webpack-contrib/webpack-bundle-analyzer/issues/263
- snyk.io/vuln/SNYK-JS-EXPRESSBASICAUTH-174345
- www.npmjs.com/advisories/827
Code Behaviors & Features
Detect and mitigate GMS-2019-23 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →