PYSEC-2020-142
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/tink/PYSEC-2020-142.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2020-142
- Aliases
- Published
- 2020-10-19T13:15:00Z
- Modified
- 2023-11-01T04:53:48.400222Z
- Summary
- [none]
- Details
-
A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting deterministic AEAD with a single key, and rely on a unique ciphertext-per-plaintext.
- References
Affected packages
PyPI / tink
Package
- Name
- tink
- View open source insights on deps.dev
- Purl
- pkg:pypi/tink