CVE-2020-8929: Tink - Mis-handling of Invalid Unicode Characters
Summary
CVE-2020-8929: A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can... Affects tink across 2 version ranges.
< 1.5.0
< 93d839a5865b9d950dffdc9d0bc99b71280a8899
Fixed in 93d839a5865b9d950dffdc9d0bc99b71280a8899. How to fix ↓
Also tracked for
- com.google.crypto.tink:tink · Maven
The same CVE-2020-8929 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tink is a Java implementation that provides a set of cryptographic APIs for secure communication and data storage. It offers various functionalities such as encryption, decryption, digital signatures, and more. Tink is widely used in applications that require secure data handling and protection. However, prior to version 1.5, Tink had a vulnerability related to the handling of invalid Unicode characters.
Vulnerability Detail
The vulnerability in Tink versions prior to 1.5 allowed an attacker to modify the ID part of a ciphertext, resulting in the creation of a second ciphertext that can decrypt to the same plaintext. This issue specifically affects the encryption of deterministic AEAD (Authenticated Encryption with Associated Data) with a single key, relying on a unique ciphertext-per-plaintext. An attacker exploiting this vulnerability could potentially gain unauthorized access to sensitive information or manipulate encrypted data.
How To Fix
Minimum fixed version
93d839a5865b9d950dffdc9d0bc99b71280a8899
This is the first release that contains the fix.
pip install --upgrade "tink==93d839a5865b9d950dffdc9d0bc99b71280a8899"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Tink versions prior to 1.5 allows an attacker to modify ciphertext and potentially gain unauthorized access or manipulate encrypted data. It is crucial to update the Tink package to version 1.5.0 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tink →
FAQ
Tink is a Java implementation that provides cryptographic APIs for secure communication and data storage.
This vulnerability allows an attacker to modify ciphertext and create a second ciphertext that can decrypt to the same plaintext, potentially leading to unauthorized access or data manipulation.
Versions prior to 1.5 of Tink are affected by this vulnerability.
To fix this vulnerability, update the Tink package to version 1.5.0 or later.
No specific workaround has been mentioned for this vulnerability.
