GitHub Advisoryadvisory · Go

GHSA-gvfj-fxx3-j323 mellium.im/sasl authentication failure due to insufficient nonce randomness

CRITICAL Published 2022-12-31 Modified 2024-05-20 Official page ↗
Aliases
CVE-2022-48195
Ecosystem
Go
Packages
mellium.im/sasl
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2023-01-04

Affected packages

• Go mellium.im/sasl: < 0.3.1 → fixed in 0.3.1

Description

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication to fail in the best case, but (if paired with a remote end that does not validate the length of the nonce) could lead to insufficient randomness being used during authentication.

Related

Alias · CVE (1)

  • CVE-2022-48195 An issue was discovered in Mellium mellium.im/sasl before 0.3.1. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References