restify / restify/node-restify
Update http-signature to fix timing attacks against signature verification on version 4.3.X
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.7k
- Forks
- 975
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 5
Description
- Used appropriate template for the issue type
- Searched both open and closed issues for duplicates of this issue
- Title adequately and concisely reflects the feature or the bug
Bug Report
Restify Version
4.3.x
Node.js Version
does not matter
Expected behaviour
Restify should be free of known security vulnerabilities.
Actual behaviour
Restify uses an old version of http-signature that has a known vulnerability
"http-signature": "^0.11.0"
This is fixed in http-signature 1.0.0 (latest versions is 1.2.0)
See joyent/node-http-signature@78ab1da
It is corrected in https://github.com/restify/node-restify/issues/1388 for version 5.x.
Repro case
n/a
Cause
Are you willing and able to fix this?
Yes
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dependency declaration for http-signature and review the linked node-http-signature fix and the related version 5.x issue. Done means the affected 4.3.x dependency no longer uses the vulnerable version and the project’s dependency checks or tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend-api-design, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100