CVE-2020-8929 - Ciphertext integrity weakness in Tink

Back Back to CVE browser

MEDIUM

Ciphertext integrity weakness in Tink

Published Oct 19, 2020

6.9

MEDIUM

CVSS 4.0

EPSS 0.46%

Description

A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting deterministic AEAD with a single key, and rely on a unique ciphertext-per-plaintext.

Affected products

Vendor Google LLC Product Tink Default
n/a
- Version
  stable
  Status
  affected
  Constraints
  <1.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google LLC

Tink

n/a

Version	Status	Constraints
stable	affected	<1.5

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-176

CWE-327

Broken Crypto Algorithm

References (5)

https://github.com/advisories/GHSA-g5vf-v6wf-7w2r
Advisory
https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/google/tink/security/advisories/GHSA-g5vf-v6wf-7w2r
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/tink/PYSEC-2020-142.yaml
https://nvd.nist.gov/vuln/detail/CVE-2020-8929

Link	Providers	Tags
https://github.com/advisories/GHSA-g5vf-v6wf-7w2r		Advisory
https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/google/tink/security/advisories/GHSA-g5vf-v6wf-7w2r		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/tink/PYSEC-2020-142.yaml
https://nvd.nist.gov/vuln/detail/CVE-2020-8929