RubyGems/shrine CVE-2020-15237: medium 5.9, EPSS 1.01%

Possible timing attack in derivation_endpoint

Action: Upgrade shrine to 3.3.0 or later.

bundle update shrine

Affected

Fixed versions

Sources

• osv: GHSA-5jjv-x4fq-qjwp
• https://github.com/shrinerb/shrine/security/advisories/GHSA-5jjv-x4fq-qjwp
• https://nvd.nist.gov/vuln/detail/CVE-2020-15237
• https://github.com/shrinerb/shrine/commit/1b27090ce31543bf39f186c20ea47c8250fca2f0
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/shrine/CVE-2020-15237.yml
• https://github.com/shrinerb/shrine

CVE-2020-15237 · published 2020-10-05T15:48:34Z · modified 2026-07-08T06:29:09.017617620Z · JSON