CVE-2024-47178: basic-auth-connect's callback uses time unsafe string comparison
Impact
basic-auth-connect <1.1.0 uses a timing-unsafe equality comparison that can leak timing information
Patches
this issue has been fixed in basic-auth-connect 1.1.0
References
Other sources
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47178?
CVE-2024-47178 is considered a moderate severity vulnerability due to the potential for timing attacks.
How do I fix CVE-2024-47178?
To fix CVE-2024-47178, update basic-auth-connect to version 1.1.0 or later.
What does CVE-2024-47178 affect?
CVE-2024-47178 affects versions of basic-auth-connect prior to 1.1.0.
What is the nature of the vulnerability in CVE-2024-47178?
CVE-2024-47178 is a timing-unsafe equality comparison that can leak sensitive timing information.
Is there a workaround for CVE-2024-47178?
There is no official workaround for CVE-2024-47178; the recommended action is to update to the patched version.