GitHub Advisory DatabaseGHSA-HP56-XVF4-G6WRCros secrets may be disclosed to untrusted relay
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.1 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.8%
An issue was discovered in Croc before 9.6.16. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/schollz/croc/v9 | lt | 9.6.16 |
References
www.openwall.com/lists/oss-security/2023/09/21/5
github.com/advisories/GHSA-hp56-xvf4-g6wr
github.com/schollz/croc/commit/0f1ca436cd8e608738da0b23bf594537cfbe6213
github.com/schollz/croc/issues/596
github.com/schollz/croc/pull/699
nvd.nist.gov/vuln/detail/CVE-2023-43617
www.openwall.com/lists/oss-security/2023/09/08/2
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.1 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.8%