Cxa6b1c6b3-0f59 @ Npm-http-signature-0.10.1 #399
Description
Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about Cxa6b1c6b3-0f59
Checkmarx Project: cx-boris-goman/AutoPR
Repository URL: https://github.com/cx-boris-goman/AutoPR
Branch: kid
Scan ID: bfaa74de-6358-4edb-a528-1d669bc0863c
Http-signature prior to 1.0.0 is vulnerable to Timing Attacks against the signature verification. The library performs strict equality comparison (===) to validate the signatures. This built-in JavaScript comparison works by comparing the values character by character, meaning the comparison returns in different amounts of time depending on how many characters match. This can be used to guess the valid signature one character at a time. The issue was mitigated by double-hashing before comparing values.
Additional Info
Attack vector: NETWORK
Attack complexity: HIGH
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 1.0.0