CVE-2020-11005: HaemmerElectronics.SeppPenner.WindowsHello - Internal NCryptDecrypt method could be used externally
Summary
CVE-2020-11005: Internal NCryptDecrypt method could be used externally from WindowsHello library. Affects HaemmerElectronics.SeppPenner.WindowsHello versions < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HaemmerElectronics.SeppPenner.WindowsHello is a NuGet package that provides functionality for encrypting text and writing the output to a txt file. It is commonly used for Windows Hello Authentication. However, versions before 1.0.4 have a vulnerability where the internal NCryptDecrypt method can be accessed externally from the library. This means that an attacker could decrypt the encrypted text without the need for Windows Hello Authentication.
Vulnerability Detail
The vulnerability in HaemmerElectronics.SeppPenner.WindowsHello allows an attacker to bypass the intended security measures by directly accessing the NCryptDecrypt method. This method should only be accessible internally within the library, but due to a flaw, it can be called externally. This means that an attacker could decrypt the encrypted text without the need for Windows Hello Authentication, potentially exposing sensitive information. The vulnerability has a CVSS score of 5.1, indicating a moderate severity.
How To Fix
Minimum fixed version
1.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update to the patched version of the HaemmerElectronics.SeppPenner.WindowsHello package to mitigate the risk.
Conclusion
The HaemmerElectronics.SeppPenner.WindowsHello package has a vulnerability that allows external access to the internal NCryptDecrypt method. This can lead to the decryption of encrypted text without the need for Windows Hello Authentication. To mitigate this risk, it is crucial to update to version 1.0.4 or later of the package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for HaemmerElectronics.SeppPenner.WindowsHello →
FAQ
HaemmerElectronics.SeppPenner.WindowsHello is a NuGet package used for encrypting text and writing the output to a txt file. It is commonly used for Windows Hello Authentication.
The vulnerability allows an attacker to decrypt the encrypted text without the need for Windows Hello Authentication, potentially exposing sensitive information.
To fix this vulnerability, update to version 1.0.4 or later of the HaemmerElectronics.SeppPenner.WindowsHello package.
No, there are no known workarounds for this vulnerability. Updating to the patched version is the recommended solution.
The vulnerability has a CVSS score of 5.1, indicating a moderate severity.
