GHSA-hp56-xvf4-g6wr

Cros secrets may be disclosed to untrusted relay

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-43617

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/schollz/croc/v9	< 9.6.16	9.6.16

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Croc before 9.6.16. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-43617 advisory
https://github.com/schollz/croc/issues/596 web
https://github.com/schollz/croc/pull/699 web
https://github.com/schollz/croc/commit/0f1ca436cd8e608738da0b23bf594537cfbe6213 web
https://github.com/schollz/croc package
https://www.openwall.com/lists/oss-security/2023/09/08/2 web
http://www.openwall.com/lists/oss-security/2023/09/21/5 web