VulnerabilityModified
CVE-2015-9238
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
MEDIUM 5.3EPSS 1.50%
Does this matter?
Lower severity and a low EPSS score (1.50%). Track it; it rarely justifies an emergency change on its own.
Description
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 1.50% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-697, CWE-134
- Affected
- secure-compare project/secure-compare
- Source
- support@hackerone.com
References
- https://github.com/vdemedes/secure-compare/pull/1Third Party Advisory
- https://nodesecurity.io/advisories/50Third Party Advisory
- https://github.com/vdemedes/secure-compare/pull/1Third Party Advisory
- https://nodesecurity.io/advisories/50Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.