Reported

February 6, 2024

Issued

February 6, 2024 (last modified: February 14, 2024)

Package

svix (crates.io)

Type

Vulnerability

Categories

• crypto-failure

Aliases

• CVE-2024-21491
• GHSA-747x-5m58-mq97
• GHSA-w277-wpqf-rcfv

References

• https://github.com/svix/svix-webhooks/pull/1190

Patched

• >=1.17.0

Affected Functions

Version

svix::webhooks::Webhook::verify

• <1.17.0

Description

The Webhook::verify function incorrectly compared signatures of different lengths - the two signatures would only be compared up to the length of the shorter signature. This allowed an attacker to pass in v1, as the signature, which would always pass verification.

Advisory available under CC0-1.0 license.