Import of Incorrectly Embargoed Keys Vulnerability in github.com/google/exposure-notifications-server
Summary
GHSA-3wxm-m9m4-cprj: Import of incorrectly embargoed keys could cause early publication. Affects github.com/google/exposure-notifications-server across 2 version ranges.
< 0.18.3
>= 0.19.0, < 0.19.2
Fixed in 0.18.3 or 0.19.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
github.com/google/exposure-notifications-server is a Go package that provides functionality for exposure notifications. It allows servers to import and export keys for contact tracing purposes. The package includes an export-importer service that is responsible for importing keys from other servers. This vulnerability affects versions 0.19.1 and earlier of the package.
Vulnerability Detail
The export-importer service in github.com/google/exposure-notifications-server assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. However, there are instances where servers did not properly embargo keys. This vulnerability allows for imported keys to be re-published before they have expired, potentially enabling replay of RPIs (Random Pseudonymous Identifiers).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.18.30.18.3go get github.com/google/exposure-notifications-server@v0.18.3 -
>= 0.19.0, < 0.19.20.19.2go get github.com/google/exposure-notifications-server@v0.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, it is recommended to ensure that the servers from which keys are imported do not publish keys too early.
Conclusion
The Import of Incorrectly Embargoed Keys vulnerability in github.com/google/exposure-notifications-server allows for the re-publication of imported keys before their expiry, potentially enabling replay of RPIs. It is recommended to update to the patched versions or ensure that keys are not published too early. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/google/exposure-notifications-server →
FAQ
The vulnerability allows for imported keys to be re-published before they have expired, potentially enabling replay of RPIs.
Versions 0.19.1 and earlier are affected.
Update to version 0.18.3 if using a version prior to 0.19.1, or update to any version 0.19.2 or later.
There is no specific workaround provided, but it is recommended to ensure that the servers from which keys are imported do not publish keys too early.
For more information, you can open an issue in the exposure-notifications-server GitHub repository or email exposure-notifications-feedback@google.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/exposure-notifications-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
