Lucene search

MitreCVE-2023-26084

HistoryMar 15, 2023 - 2:15 p.m.

CVE-2023-26084

2023-03-1514:15:11

CWE-665

mitre

web.nvd.nist.gov

arm aarch64cryptolib

api

authentication tag

aes-gcm

man-in-the-middle attack

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

27.1%

JSON

The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable.

Affected configurations

Nvd

Node

armaarch64cryptolibRange<2023-02-20

VendorProductVersionCPE
armaarch64cryptolib*cpe:2.3:a:arm:aarch64cryptolib:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arm	aarch64cryptolib	*	cpe:2.3:a:arm:aarch64cryptolib::::::::

References

github.com/ARM-software/AArch64cryptolib/security/advisories/GHSA-47c6-7x5x-r74g

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

27.1%

JSON

Related for CVE-2023-26084