CVE-2015-20110
1 advisory.
npm/generator-jhipster CVE-2015-20110: high 7.5
generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character
Action: Upgrade generator-jhipster to 2.23.0 or later.
npm i generator-jhipster@2.23.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.23.0 | - |
Fixed versions
| 2.23.0 |
Sources
- osv: GHSA-4gpm-r23h-gprw
- https://nvd.nist.gov/vuln/detail/CVE-2015-20110
- https://github.com/jhipster/generator-jhipster/issues/2095
- https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc
- https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25
- https://github.com/jhipster/generator-jhipster
- https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0
CVE-2015-20110 · published · modified · JSON