QID 983135

QID 983135: Java (maven) Security Update for com.linecorp.armeria:armeria (GHSA-24r8-fm9r-cpj2)

Security update has been released for com.linecorp.armeria:armeria to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

String comparison method in multiple authentication validation in Armeria were known to be vulnerable to timing attacks. This vulnerability is caused by the insecure implementation of `equals` method from `java.lang.String`. While this attack is not practically possible, an attacker still has a potential to attack if the victim's server validates user by using `equals` method.

We would like to thank @chrsow for pointing out the issue.

## Potentially vulnerable codes

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/OAuth2Token.java#L54
https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/BasicToken.java#L64

  • CVSS V3 rated as High - 6.5 severity.
  • CVSS V2 rated as Medium - 5 severity.
    • Solution
    There are two options to patch this issue.

    1. Remove `equals` method; it has been exclusively used for test cases and was never used in any OSS projects that are using Armeria. (But it is worth noting that there are possibilities of closed projects authenticating users by utilizing `equals` method)

    2. Use `MessageDigest.isEqual` to compare the credential instead.Workaround:
    1. Update to the latest version (TBD)

    2-1. Users can prevent these vulnerabilities by modifying and implementing timing attack preventions by themselves.

    2-2. Precisely speaking, it is possible to compare credentials by securely comparing them after calling methods to directly return the input (namely `Object. accessToken()`, `Object.username()` and `Object.password()`).
    Vendor References

    CVEs related to QID 983135

    CVE-2019-16771 |
    Software Advisories
    Advisory ID Software Component Link
    GHSA-24r8-fm9r-cpj2 com.linecorp.armeria:armeria URL Logo github.com/advisories/GHSA-24r8-fm9r-cpj2
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].