PT-2023-24616 · Briar · Briar

Kenny Paterson + 1 · Publicado 2023-05-24 · Atualizado 2025-01-16 · CVE-2023-33982

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Briar versions prior to 1.5.3

Description The issue affects the Bramble Handshake Protocol (BHP) in Briar, allowing eavesdroppers to decrypt network traffic between two accounts if they later compromise both accounts. However, the eavesdropping is typically impractical because BHP runs over an encrypted session that uses the Tor hidden service protocol.

Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2023-33982

Produtos afetados

Briar

Referências · 7

• 🔥 https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf · Exploit
• https://t.me/cvenotify/107640 · Publicação no Telegram
• https://t.me/cibsecurity/64714 · Publicação no Telegram
• https://t.me/cvenotify/51075 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33982 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33982 · Aviso do Fabricante
• https://briarproject.org/news/2023-three-security-issues-found-and-fixed · Aviso do Fabricante