GHSA-5jjv-x4fq-qjwp

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-5jjv-x4fq-qjwp/GHSA-5jjv-x4fq-qjwp.json

Aliases

• CVE-2020-15237

Published

2020-10-05T15:48:34Z

Modified

2023-05-16T16:31:01.972938Z

Details

Impact

When using the derivation_endpoint plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL.

Patches

The problem has been fixed by comparing sent and calculated signature in constant time, using Rack::Utils.secure_compare. Users using the derivation_endpoint plugin are urged to upgrade to Shrine 3.3.0 or greater.

Workarounds

Users of older Shrine versions can apply the following monkey-patch after loading the derivation_endpoint plugin:

class Shrine
  class UrlSigner
    def verify_signature(string, signature)
      if signature.nil?
        fail InvalidSignature, "missing \"signature\" param"
      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
        fail InvalidSignature, "provided signature does not match the calculated signature"
      end
    end
  end
end

References

You can read more about timing attacks here.

References

• https://github.com/shrinerb/shrine/security/advisories/GHSA-5jjv-x4fq-qjwp
• https://nvd.nist.gov/vuln/detail/CVE-2020-15237
• https://github.com/shrinerb/shrine/commit/1b27090ce31543bf39f186c20ea47c8250fca2f0
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/shrine/CVE-2020-15237.yml
• https://github.com/shrinerb/shrine