Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update http-signature to prevent timing attacks #1401

Merged
merged 2 commits into from
Jul 6, 2017
Merged

Update http-signature to prevent timing attacks #1401

merged 2 commits into from
Jul 6, 2017

Conversation

dotchev
Copy link
Contributor

@dotchev dotchev commented Jul 5, 2017

Fixes #1388

Affected versions of the package are vulnerable to Timing Attacks due to time-variable comparison of signatures. A malicious user can guess a valid signature one char at a time by considering the time it takes a signature validation to fail.

https://snyk.io/vuln/npm:http-signature:20150122

@retrohacker retrohacker merged commit ec88737 into restify:5.x Jul 6, 2017
@retrohacker
Copy link
Member

Failing tests are Node.js v8 specific, merging.

Thanks for the PR @dotchev ❤️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Bug Dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@dotchev @retrohacker