id: GO-2023-1294
modules:
    - module: github.com/agnivade/easy-scrypt
      versions:
        - fixed: 1.0.0
summary: easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt
cves:
    - CVE-2014-125055
ghsas:
    - GHSA-r894-5r7v-7rx3
references:
    - advisory: https://github.com/advisories/GHSA-r894-5r7v-7rx3
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2014-125055
    - fix: https://github.com/agnivade/easy-scrypt/commit/477c10cf3b144ddf96526aa09f5fdea613f21812
    - web: https://github.com/agnivade/easy-scrypt/releases/tag/v1.0.0
    - web: https://vuldb.com/?ctiid.217596
    - web: https://vuldb.com/?id.217596
notes:
    - fix: 'github.com/agnivade/easy-scrypt: could not add vulnerable_at: could not find tagged version between introduced and fixed'
source:
    id: GHSA-r894-5r7v-7rx3
    created: 2024-08-20T11:28:09.081427-04:00
review_status: UNREVIEWED
unexcluded: NOT_IMPORTABLE