CVE-2023-40104: Remove E-Tugra certificates in platform/system/ca-certificates
Summary
CVE-2023-40104: In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. Affects platform/external/conscrypt versions >= 14-next:0, < 14-next:2023-11-01. Fixed in 14-next:2023-11-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/system/ca-certificates package is a component of the Android ecosystem. It is responsible for managing the trusted cryptographic certificates used for secure communication over TLS. These certificates ensure the authenticity and integrity of the data transmitted between devices. However, a vulnerability has been identified in this package that allows for the reading of encrypted TLS data due to untrusted E-Tugra certificates. This vulnerability can be exploited remotely without requiring any additional execution privileges or user interaction.
Vulnerability Detail
The vulnerability in platform/system/ca-certificates arises from the presence of untrusted cryptographic certificates issued by E-Tugra. These certificates can be used to decrypt encrypted TLS data, leading to remote information disclosure. An attacker can exploit this vulnerability to intercept and read sensitive data transmitted over TLS connections, potentially compromising user privacy and security. The vulnerability affects Android versions 11, 12, 12L, and 13.
How To Fix
Minimum fixed version
14-next:2023-11-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to apply the fix by updating the ca-certificates package.
Conclusion
The presence of untrusted E-Tugra certificates in the platform/system/ca-certificates package poses a significant security risk, allowing for the reading of encrypted TLS data. To mitigate this vulnerability, it is crucial to update the ca-certificates package to the fixed version provided by the Android team. Prompt action is recommended to ensure the privacy and security of Android devices.
See every vulnerability recorded for platform/external/conscrypt →
FAQ
This vulnerability allows for the reading of encrypted TLS data, potentially leading to remote information disclosure. It can be exploited by attackers to intercept and read sensitive data transmitted over TLS connections.
Android versions 11, 12, 12L, and 13 are affected by this vulnerability.
No, user interaction is not needed for exploitation of this vulnerability.
This vulnerability is classified as high severity.
More information about the fix can be found in the Android Security Bulletin published on November 1, 2023.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/conscrypt.
