Timing Attack Affecting clearance package, versions <2.2.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-CLEARANCE-20418
- published 7 Dec 2017
- disclosed 27 Jan 2016
- credit Derek Prior
How to fix?
Upgrade clearance to version 2.2.1 or higher.
Overview
clearance is an authentication app for rails.
Affected versions of this package are vulnerable to Timing Attack. When attempting to authenticate a user, but no user was found with the provided email address, it skips calls to BCrypt. This allows attackers to time the response from the app to see if the provided user has an account, and help when attempting to guess a users password.
References
CVSS Scores
version 3.1