GHSA-WVPV-FFCV-R6CW中危已审查

Internal NCryptDecrypt method could be used externally from WindowsHello library.

OSV 1.4.0 · github-reviewed · 修改于 2021-01-09 04:22

发布时间

2020-04-15 07:09

GitHub 审查时间

2020-04-15 06:26

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/04/GHSA-wvpv-ffcv-r6cw/GHSA-wvpv-ffcv-r6cw.json

公告说明

Impact

Every user of the library before version 1.0.4.

Patches

Patched in 1.0.4+.

Workarounds

None.

References

https://github.com/SeppPenner/WindowsHello/issues/3

For more information

It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.

受影响的软件包

NuGet

HaemmerElectronics.SeppPenner.WindowsHello

ECOSYSTEM

标识信息

别名 / CVE

CVE-2020-11005

CWE

CWE-288

软件生态

NuGet

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-wvpv-ffcv-r6cw",
  "aliases": [
    "CVE-2020-11005"
  ],
  "details": "### Impact\nEvery user of the library before version 1.0.4.\n\n### Patches\nPatched in 1.0.4+.\n\n### Workarounds\nNone.\n\n### References\nhttps://github.com/SeppPenner/WindowsHello/issues/3\n\n### For more information\nIt this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library  without the need to use Windows Hello Authentication again.",
  "summary": "Internal NCryptDecrypt method could be used externally from WindowsHello library.",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.4"
            }
          ]
        }
      ],
      "package": {
        "name": "HaemmerElectronics.SeppPenner.WindowsHello",
        "ecosystem": "NuGet"
      }
    }
  ],
  "modified": "2021-01-08T20:22:38Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2020-04-14T23:09:13Z",
  "references": [
    {
      "url": "https://github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6cw",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11005",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/SeppPenner/WindowsHello/issues/3",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-288"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-04-14T22:26:38Z"
  }
}