CVE-2020-15237

Name of the Vulnerable Software and Affected Versions Shrine versions prior to 3.3.0

Description The issue allows an attacker to use a timing attack to guess the signature of the derivation URL when using the derivation endpoint plugin. This is possible due to the comparison of sent and calculated signatures not being done in constant time. The problem has been fixed by using Rack::Utils.secure compare to compare signatures in constant time.

Recommendations For Shrine versions prior to 3.3.0, upgrade to Shrine 3.3.0 or greater. As a temporary workaround, users of older Shrine versions can apply a monkey-patch after loading the derivation endpoint plugin to secure the comparison of signatures.