Vulnerability	Vulnerable Version
M Timing Attack `twilio` is a Twilio API client and TwiML generator. Affected versions of this package are vulnerable to Timing Attacks. `twilio.util.RequestValidator` uses `==` to compare signatures, and this operation is designed to return a value as quickly as possible, meaning the signature check will take a variable amount of time based on how "correct" the submitted signature is. An attacker can use this timing information to determine the correct signature, one character at a time.	[3.0.0,3.5.0)

Timing Attack

twilio is a Twilio API client and TwiML generator.

Affected versions of this package are vulnerable to Timing Attacks. twilio.util.RequestValidator uses == to compare signatures, and this operation is designed to return a value as quickly as possible, meaning the signature check will take a variable amount of time based on how "correct" the submitted signature is. An attacker can use this timing information to determine the correct signature, one character at a time.

[3.0.0,3.5.0)

Go back to all versions of this package