EUVD-2020-1413

Malware in sbrugna...

CVE-2020-15237

In Shrine before version 3.3.0, when using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare...

Timing Attack

Overview shrine is a toolkit for file attachments in Ruby applications. Affected versions of this package are vulnerable to Timing Attack when using the derivationendpoint plugin, allowing the attacker to guess the signature of the derivation URL. Remediation Upgrade shrine to version 3.3.0 or...

CVE-2020-15237 Timing attack in Shrine

In Shrine before version 3.3.0, when using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare...

GHSA-5JJV-X4FQ-QJWP Possible timing attack in derivation_endpoint

Impact When using the derivationendpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. Patches The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.securecompare. Users using the...

PT-2020-14303

Name of the Vulnerable Software and Affected Versions Shrine versions prior to 3.3.0 Description The issue allows an attacker to use a timing attack to guess the signature of the derivation URL when using the derivation endpoint plugin. This is possible due to the comparison of sent and calculate...