Skip to content
Fencer Intel
medium —

GHSA-3wxm-m9m4-cprj json

Import of incorrectly embargoed keys could cause early publication

published 5y ago modified 8mo ago also GO-2022-0381

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

If your installation is using the `export-importer` service, there is potential impact. If your installation is not importing keys via the `export-importer` services, your installation is not impacted.

In versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.

This could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.

### Patches

This is patched in `v0.18.3` and all versions `0.19.2` and later.

### Workarounds

Ensure that the servers you are importing export zip files from are not publishing keys too early.

### References

n/a

### For more information

If you have any questions or comments about this advisory * Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/) * Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)

Patch / fix

  • go github.com/google/exposure-notifications-server 0.18.3, 0.19.2

Is GHSA-3wxm-m9m4-cprj in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/google/exposure-notifications-server
<0.18.3
>=0.19.0, <0.19.2
0.18.3
0.19.2

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.