---
title: "GHSA-92vm-wfm5-mxvv: cookie-signature Timing Attack"
description: "Moderate severity. cookie-signature Timing Attack. Affects cookie-signature; fixed in 1.0.4."
url: https://inlinr.com/advisories/GHSA-92vm-wfm5-mxvv
lang: en
---

[Packages](https://inlinr.com/packages) / [cookie-signature](https://inlinr.com/packages/cookie-signature) / [Security](https://inlinr.com/packages/cookie-signature/security)

Moderate Vulnerability GHSA-92vm-wfm5-mxvv CVE-2016-1000236 Published 6 Jan 2020

# cookie-signature Timing Attack

Your version 

Affected releases · [cookie-signature](https://inlinr.com/packages/cookie-signature)

- 1.x 1.0.0 – 1.0.3 Fixed in 1.0.4
- 0.0.x 0.0.1 No fix on this line yet

On 1.x, the newest line:

```
npm install cookie-signature@1.0.4
```

Every release on a timeline

1.x 

1. Affected

1.0.0 – 1.0.3  
4 releases
2. Fixed

1.0.4 – 1.2.2  
8 releases, latest

0.x 

1. Affected

0.0.1  
1 release

13 stable releases of cookie-signature, oldest to newest, one row per major.

## What happens

Affected versions of `cookie-signature` are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison. 

Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.

Under favorable network conditions, an attacker can exploit this to guess the secret in no more than `charset*length` guesses, instead of `charset^length` guesses required were the timing attack not present. 

Recommendation

Update to 1.0.4 or later.

## How it is exploited

Exploitable over the network, with an admin account and no action from a user.

- **Confidentiality**: high
- **Integrity**: none
- **Availability**: none

CVSS:3.1/​AV:N/​AC:H/​PR:H/​UI:N/​S:U/​C:H/​I:N/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-1000236 "https://nvd.nist.gov/vuln/detail/CVE-2016-1000236")  
nvd.nist.gov/vuln/detail/CVE-2016-1000236
- [Fix commit](https://github.com/tj/node-cookie-signature/commit/2c4df6b6cee540f30876198cd0b5bebf28528c07 "https://github.com/tj/node-cookie-signature/commit/2c4df6b6cee540f30876198cd0b5bebf28528c07")  
2c4df6b
- [Fix commit](https://github.com/tj/node-cookie-signature/commit/39791081692e9e14aa62855369e1c7f80fbfd50e "https://github.com/tj/node-cookie-signature/commit/39791081692e9e14aa62855369e1c7f80fbfd50e")  
3979108
- [Fix commit](https://github.com/tj/node-cookie-signature/commit/4cc5e21e7f59a4ea0b51cd5e9634772d48fab590 "https://github.com/tj/node-cookie-signature/commit/4cc5e21e7f59a4ea0b51cd5e9634772d48fab590")  
4cc5e21
- [Reference](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838618 "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838618")  
bugs.debian.org/cgi-bin/bugreport.cgi
- [Reference](https://bugzilla.redhat.com/show%5Fbug.cgi?id=1371409 "https://bugzilla.redhat.com/show_bug.cgi?id=1371409")  
bugzilla.redhat.com/show\_bug.cgi
- [Reference](https://bugzilla.redhat.com/show%5Fbug.cgi?id=CVE-2016-1000236 "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000236")  
bugzilla.redhat.com/show\_bug.cgi
- [Package](https://github.com/tj/node-cookie-signature "https://github.com/tj/node-cookie-signature")  
github.com/tj/node-cookie-signature
- [Reference](https://security-tracker.debian.org/tracker/CVE-2016-1000236 "https://security-tracker.debian.org/tracker/CVE-2016-1000236")  
security-tracker.debian.org/tracker/CVE-2016-10…
- [Reference](https://travis-ci.com/nodejs/security-wg/builds/76423102 "https://travis-ci.com/nodejs/security-wg/builds/76423102")  
travis-ci.com/nodejs/security-wg/builds/76423102
- [Reference](https://www.mail-archive.com/secure-testing-team@lists.alioth.debian.org/msg06583.html "https://www.mail-archive.com/secure-testing-team@lists.alioth.debian.org/msg06583.html")  
mail-archive.com/secure-testing-team@lists.alio…
- [Reference](https://www.npmjs.com/advisories/134 "https://www.npmjs.com/advisories/134")  
npmjs.com/advisories/134