CVE-2022-31142

🗓️ 14 Jul 2022 18:55:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 66 Views

@fastify/bearer-auth plugin insecurely uses crypto.timingSafeEqua

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-31142	17 Jul 202216:01	–	circl
CNNVD	Fastify 安全漏洞	14 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-31142 Potential Timing Attack Vector in @fastify/bearer-auth	14 Jul 202218:55	–	cvelist
EUVD	EUVD-2022-6214	3 Oct 202520:07	–	euvd
Github Security Blog	fastify-bearer-auth vulnerable to Timing Attack Vector	15 Jul 202219:14	–	github
NVD	CVE-2022-31142	14 Jul 202219:15	–	nvd
OSV	CVE-2022-31142 Potential Timing Attack Vector in @fastify/bearer-auth	14 Jul 202218:55	–	osv
OSV	GHSA-376V-XGJX-7MFR fastify-bearer-auth vulnerable to Timing Attack Vector	15 Jul 202219:14	–	osv
Prion	Authorization	14 Jul 202219:15	–	prion
RedhatCVE	CVE-2022-31142	9 Jan 202608:42	–	redhatcve

NVD

Vulners

Node

fastify bearer-authRange5.0.1–7.0.2node.js

fastify bearer-authMatch8.0.0node.js

[
  {
    "product": "fastify-bearer-auth",
    "vendor": "fastify",
    "versions": [
      {
        "status": "affected",
        "version": ">= 5.0.1, < 7.0.2"
      },
      {
        "status": "affected",
        "version": "= 8.0.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/fastify/fastify-bearer-auth/security/advisories/GHSA-376v-xgjx-7mfr
github	www.github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4
github	www.github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716
hackerone	www.hackerone.com/reports/1633287
github	www.github.com/fastify/fastify-bearer-auth/commit/f921a0582dc83112039004a9b5041141b50c5b3f

21 Nov 2024 07:03Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.00739

SSVC