CVE-2023-42811

aes-gcm project aes-gcm, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-42811

Katalog CVE

CVSS 5.5 · Medium EPSS 0,23%

Kerentanan Improper Verification of Cryptographic Signature pada aes-gcm project aes-gcm, fedoraproject fedora. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.

Rincian

Terbit di NVD
22 September 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-347: Improper Verification of Cryptographic Signature
EPSS (30 hari)
0,23% peluang dieksploitasi; lebih tinggi dari 12,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
aes-gcm project aes-gcm Versi 0.10.0 hingga sebelum 0.10.3
fedoraproject fedora Versi 37
fedoraproject fedora Versi 38
fedoraproject fedora Versi 39

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.