CVE-2014-125055 json
agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancy
published 3y ago modified 4mo ago also GHSA-r894-5r7v-7rx3 , GO-2023-1294 , EUVD-2023-0542
- cvss
- 2.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 477c10cf3b144ddf96526aa09f5fdea613f21812. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217596.
Patch / fix
- go github.com/agnivade/easy-scrypt 1.0.0
- easy-script_project easy-script 1.0.0
Is CVE-2014-125055 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.6 | CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.0 | 2.6 | CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 1.4 | AV:A/AC:H/Au:S/C:P/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/agnivade/easy-scrypt | <1.0.0 |
1.0.0 |
Affected products
- agnivade easy-scrypt
Classification
- Weakness
-
- CWE-208 Observable Timing Discrepancy
References
-
github.com
/agnivade/easy-scrypt/commit/477c10cf3b144ddf96526aa09f5fdea613f21812
patch, web, third-party-advisory
-
github.com
/agnivade/easy-scrypt/releases/tag/v1.0.0
patch, web, release-notes, third-party-advisory
-
vuldb.com
/?id.217596
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.217596
signature, permissions-required, web, third-party-advisory, vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2014-125055
advisory
-
github.com
/agnivade/easy-scrypt
package
-
github.com
/advisories/GHSA-r894-5r7v-7rx3
advisory
Sources
- CVE List CVE-2014-125055
- GitHub Advisory GHSA-r894-5r7v-7rx3
- NVD CVE-2014-125055
- OSV GO-2023-1294
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.