CVE-2023-42811: AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure
(updated )
In the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails.
References
- docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html
- github.com/RustCrypto/AEADs
- github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq
- github.com/advisories/GHSA-423w-p2w9-r7vq
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF
- nvd.nist.gov/vuln/detail/CVE-2023-42811
- rustsec.org/advisories/RUSTSEC-2023-0096.html
Code Behaviors & Features
Detect and mitigate CVE-2023-42811 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →