{"action":"Upgrade shrine to 3.3.0 or later.","affected":[{"fixed":"3.3.0","introduced":"0"}],"component":"shrine","cve_ids":["CVE-2020-15237"],"ecosystem":"RubyGems","epss":0.01015,"exploited":false,"fixed_versions":["3.3.0"],"ghsa_id":"GHSA-5jjv-x4fq-qjwp","id":"tcs_01M5KEH1KQDZSN49XE8VFZ3F20","modified_at":"2026-07-08T06:29:09.017617620Z","published_at":"2020-10-05T15:48:34Z","references":["https://osv.dev/vulnerability/GHSA-5jjv-x4fq-qjwp","https://github.com/shrinerb/shrine/security/advisories/GHSA-5jjv-x4fq-qjwp","https://nvd.nist.gov/vuln/detail/CVE-2020-15237","https://github.com/shrinerb/shrine/commit/1b27090ce31543bf39f186c20ea47c8250fca2f0","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/shrine/CVE-2020-15237.yml","https://github.com/shrinerb/shrine"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-5jjv-x4fq-qjwp","url":"https://osv.dev/vulnerability/GHSA-5jjv-x4fq-qjwp"}],"summary":"Possible timing attack in derivation_endpoint"}