CVE-2023-32691 ginuerzh/gost vulnerable to Timing Attack

2023-05-3003:06:06

CWE-203

GitHub_M

www.cve.org

gost

golang

timing attack

constant-time comparison

http header

crypto/subtle

side-channel

security vulnerability

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

0.001 Low

EPSS

Percentile

48.7%

JSON

gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a secret. Since this comparison is not secure, an attacker can mount a side-channel timing attack to guess the password. As a workaround, this can be easily fixed using a constant time comparing function such as crypto/subtle’s ConstantTimeCompare.

CNA Affected

[
  {
    "vendor": "ginuerzh",
    "product": "gost",
    "versions": [
      {
        "version": "<= 2.11.5",
        "status": "affected"
      }
    ]
  }
]