Timing Attack

Affecting fernet package, versions <0.1.0 >=0.0.1

Do your applications use this vulnerable package? Test your applications

Overview

fernet is a Javascript implementation of Fernet symmetric encryption. Affected versions of the package are vulnerable to a timing attack.

The library implemented a character to character comparison, similar to the built-in string comparison mechanism, ===, and not a time constant string comparison. As a result, the comparison will fail faster when the first characters in the HMAC are incorrect. An attacker can use this difference to perform a timing attack, essentially allowing them to guess the HMAC one character at a time.

You can read more about timing attacks in Node.js on the Snyk blog.

Remediation

Upgrade fernet to version 0.1.0 or higher.

References

CVSS Score

5.9
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    None
  • Availability
    None
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Credit
Chris Continanza
CWE
CWE-208
Snyk ID
npm:fernet:20140306
Disclosed
06 Mar, 2014
Published
22 Nov, 2016