Timing Attack Affecting github.com/nanobox-io/golang-nanoauth package, versions *
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.14% (50th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMNANOBOXIOGOLANGNANOAUTH-543840
- published 31 Jan 2020
- disclosed 31 Jan 2020
- credit @bouk
Introduced: 31 Jan 2020
CVE-2020-36569 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
github.com/nanobox-io/golang-nanoauth is a library that provides a uniform means of serving HTTP/S for golang projects securely.
Affected versions of this package are vulnerable to Timing Attack during auth token validation, when the ListenAndServe functions are called with an empty token, so the token authentication is disabled globally for all listeners, which allows the exploitation of this vulnerability.
Note:
The vulnerability was fixed in version v0.0.0-20200131131040-063a3fb69896.