Medium, CVSS 4.4npmAmendedPublished
cookie-signature Timing Attack
CVE-2016-1000236 · GHSA-92vm-wfm5-mxvv
- Affected
- npm cookie-signature < 1.0.4
- Fixed in
- 1.0.4· Vendor fix available
- Issue
- Affected versions of cookie-signature are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences. Under favorable network conditions, an attacker can exploit this to guess the secret in no more than charsetlength guesses, instead of charset^length guesses required were the timing attack not present. Recommendation Update to 1.0.4 or later.
Recommended action: Upgrade to 1.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.