CVE-2021-4239

Published: Dic 27, 2022 Last Modified: Apr 14, 2025 EU-VD ID: EUVD-2022-7529 Aliases: GHSA-6cr6-fmvc-vw2p
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0013
Percentile
0,3th
Updated

EPSS Score Trend (Last 90 Days)

311

Missing Encryption of Sensitive Data

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Application Data Modify Application Data
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
Application

Noise by Noiseprotocol

Product Information
Vendor Noiseprotocol
Product Noise
Version -
cpe:2.3:a:noiseprotocol:noise:-:*:*:*:*:go:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/flynn/noise/pull/44
Patch Third Party Advisory
https://github.com/flynn/noise/pull/44
https://pkg.go.dev/vuln/GO-2022-0425
Patch Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-0425
https://github.com/flynn/noise/pull/44
Patch Third Party Advisory
https://github.com/flynn/noise/pull/44
https://pkg.go.dev/vuln/GO-2022-0425
Patch Vendor Advisory
https://pkg.go.dev/vuln/GO-2022-0425