GitHub Advisoryadvisory · NuGet

GHSA-wvpv-ffcv-r6cw Internal NCryptDecrypt method could be used externally from WindowsHello library.

MEDIUM Published 2020-04-14 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-11005
Ecosystem
NuGet
Packages
HaemmerElectronics.SeppPenner.WindowsHello
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-288
Reviewed
2020-04-14

Affected packages

• NuGet HaemmerElectronics.SeppPenner.WindowsHello: < 1.0.4 → fixed in 1.0.4

Description

Impact Every user of the library before version 1.0.4. Patches Patched in 1.0.4+. Workarounds None. References https://github.com/SeppPenner/WindowsHello/issues/3 For more information It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.

Related

Alias · CVE (1)

  • CVE-2020-11005 The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where… vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References