high7.5
CVE-2024-47178
basic-auth-connect's callback uses time unsafe string comparison
Impact
### Impact basic-auth-connect <1.1.0 uses a timing-unsafe equality comparison that can leak timing information ### Patches this issue has been fixed in basic-auth-connect 1.1.0 ### References
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | basic-auth-connect | < 1.1.0 | 1.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Expressjs | Basic-Auth-Connect | before 1.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/expressjs/basic-auth-connect/commit/bac1e6a8530e1efd0028800b9b588a37adb0d203
- https://github.com/expressjs/basic-auth-connect/security/advisories/GHSA-7p89-p6hx-q4fw
- https://github.com/advisories/GHSA-7p89-p6hx-q4fw
- https://nvd.nist.gov/vuln/detail/CVE-2024-47178