Lucene search

GoogleOSV:GHSA-HP56-XVF4-G6WR

HistorySep 20, 2023 - 6:30 a.m.

Cros secrets may be disclosed to untrusted relay

2023-09-2006:30:50

Google

osv.dev

croc security issue

shared secret disclosure

untrusted relay vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

An issue was discovered in Croc before 9.6.16. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.

CPENameOperatorVersion
github.com/schollz/croc/v9lt9.6.16

CPE	Name	Operator	Version
	github.com/schollz/croc/v9	lt	9.6.16

References

www.openwall.com/lists/oss-security/2023/09/21/5

github.com/schollz/croc

github.com/schollz/croc/commit/0f1ca436cd8e608738da0b23bf594537cfbe6213

github.com/schollz/croc/issues/596

github.com/schollz/croc/pull/699

nvd.nist.gov/vuln/detail/CVE-2023-43617

www.openwall.com/lists/oss-security/2023/09/08/2

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for OSV:GHSA-HP56-XVF4-G6WR