NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

Time-Based Information Disclosure Vulnerability in FlowGHSA-6pq8-67pw-j6hw

MEDIUM

GHSA-6pq8-67pw-j6hw is a medium-severity (CVSS 5.3) vulnerability in neos/flow. A fix is available for neos/flow — see the affected versions and patch details below.

Published
Updated
Affected
5 pkgs
Patched
5 / 5
Exploits
None indexed
Exploitation data as of Dec 2, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

5 pkgs affected
🐘neos/flow🐘neos/flow🐘neos/flow🐘neos/flow🐘neos/flow

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

The PersistedUsernamePasswordProvider was prone to a information disclosure of account existance based on timing attacks as the hashing of passwords was only done in case an account was found. We changed the core so that the provider always does a password comparison in case credentials were submitted at all.

Affected Packages

5 total 5 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistneos/flow≥ 2.3.0&&< 2.3.162.3.16composer require neos/flow:^2.3.16
🐘Packagistneos/flow≥ 3.0.0&&< 3.0.103.0.10composer require neos/flow:^3.0.10
🐘Packagistneos/flow≥ 3.1.0&&< 3.1.73.1.7composer require neos/flow:^3.1.7
🐘Packagistneos/flow≥ 3.2.0&&< 3.2.73.2.7composer require neos/flow:^3.2.7
🐘Packagistneos/flow≥ 3.3.0&&< 3.3.53.3.5composer require neos/flow:^3.3.5

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for neos/flow, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update neos/flow to 2.3.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-6pq8-67pw-j6hw is resolved across your whole dependency graph.

  3. Workarounds

    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

The PersistedUsernamePasswordProvider was prone to a information disclosure of account existance based on timing attacks as the hashing of passwords was only done in case an account was found. We changed the core so that the provider always does a password comparison in case credentials were submitted at all.
O3 Security · Impact-Aware SCA

Is GHSA-6pq8-67pw-j6hw in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Time-Based Information Disclosure Vulnerability in Flow