GHSA-jcjx-c3j3-44pr

    Dashboard / Vulnerabilities / GHSA-jcjx-c3j3-44pr

    GHSA-jcjx-c3j3-44pr

    Published: 10 Nov 2021Last Modified: 8 Nov 2021

    Summary: Insufficient Session Expiration in @cyyynthia/tokenize

    Details: ### Impact A bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the `lastTokenReset` field. ### Patches Version 1.1.3 contains a patch that'll invalidate these faulty tokens and make new ones behave as expected. ### Workarounds None. Tokens do not hold the necessary information to perform invalidation anymore. ### References PR #1 ### For more information If you have any questions or comments about this advisory: * Open an issue in [github.com/cyyynthia/tokenize](https://github.com/cyyynthia/tokenize) * Email us at [[email protected]](mailto:[email protected])

    References: https://github.com/cyyynthia/tokenize/security/advisories/GHSA-jcjx-c3j3-44pr, https://github.com/cyyynthia/tokenize

    Affected packages

    Package

    Name: @cyyynthia/tokenize

    Purl: pkg:npm/%40cyyynthia/tokenize

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 1.1.0
    Fixed -1.1.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-jcjx-c3j3-44pr | CVE-DB