地图 / ChaCha20-Poly1305 with long nonces

ChaCha20-Poly1305 with long nonces

密码学缺陷 / Missing Encryption of Sensitive Data / #506040

厂商: Internet Bug Bounty
严重程度: 中危 · CVSS 7.4
赏金: —
弱点: Missing Encryption of Sensitive Data
研究员: @jorandirkgreef
披露日期: 2019-09-30
资产: OpenSSL (Legacy)
CVE: CVE-2019-1543

该报告还没有中文解读。

原文摘录

摘自原文（1556 字符中的一小部分）

This report relates to CVE-2019-1543, https://www.openssl.org/news/secadv/20190306.txt, which I reported to the OpenSSL maintainers a few days ago.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

2019-03-07报告提交
2019-09-30公开披露

阅读 HackerOne 原文 ↗作者 @jorandirkgreef · 版权归作者与 Internet Bug Bounty 所有

同类报告

Password and mail address stored unencrypted in memory - Rockstar Game LauncherRockstar Games · 2023-10-27 · $750 curl HSTS long file name clears contentsInternet Bug Bounty · 2024-01-20 sensitive data-creds for database - private keyMars · 2024-11-19 CVE-2023-46219: HSTS long file name clears contentscurl · 2023-12-08 Unauthenticated phpinfo()files could lead to ability file read at █████████ [HtUS]U.S. Dept Of Defense · 2023-01-06 When uploading attachments, unencrypted file names are made available to the serverBitwarden · 2021-08-02