CVE-2024-4420

CVE-2024-4420 documents a Denial-of-Service in Google Tink-cc, affecting versions prior to 2.1.3. The vulnerability stems from the crypto::tink::JsonKeysetReader when fed inputs that are valid JSON elements but not encoded JSON objects (e.g., a number or an array), causing a crash, and potentiall...

CVE-2024-4420: Improper Encoding or Escaping of Output

There exists a Denial of service vulnerability in Tink-cc in versions prior to 2.1.3. An adversary can crash binaries using the crypto::tink::JsonKeysetReader in tink-cc by providing an input that is not an encoded JSON object, but still a valid encoded JSON element, for example a number or an...

Google Tink 安全漏洞

Google Tink is a multi-language, cross-platform development library providing cryptographic APIs from Google, Inc. A security vulnerability exists in Google Tink versions prior to 2.1.3, which stems from a crypto tink JsonKeysetReader may crash due to invalid input...