GO-2023-1992

vendorUSosv

Misleading message verification in golang.org/x/crypto/openpgp/clearsign

view advisory published 2023-08-23Licence: per source

The clearsign package accepts some malformed messages, making it possible for an attacker to trick a human user (but not a Go program) into thinking unverified text is part of the message. With fix, messages with malformed headers in the SIGNED MESSAGE section are rejected.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-11841US	medium5.9	2.00% (81st)	—	2019-05-22
A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format speci…

references

External citations — patches, advisories, analysis.

https://go-review.git.corp.google.com/c/crypto/+/173778FIX
https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442FIX
https://groups.google.com/d/msg/golang-openpgp/6vdgZoTgbIY/K6bBY9z3DAAJWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan