PT-2020-20372 · Google · Tink

Peter Esbensen · Published 2020-10-16 · Updated 2025-06-05 · CVE-2020-8929

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tink versions prior to 1.5

Description A mis-handling of invalid unicode characters in the Java implementation of Tink allows an attacker to change the ID part of a ciphertext, resulting in the creation of a second ciphertext that can decrypt to the same plaintext. This issue compromises ciphertext integrity, particularly when encrypting with a deterministic AEAD using a single key and relying on a unique ciphertext-per-plaintext. No loss of confidentiality or plaintext integrity occurs due to this problem.

Recommendations For Tink versions prior to 1.5, the issue was fixed in a specific pull request. As a workaround, consider backporting the fixing pull request until a newer version is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-176

Related Identifiers

CVE-2020-8929

GHSA-G5VF-V6WF-7W2R

PYSEC-2020-142

Affected Products

Tink

References · 8

• https://github.com/google/tink/security/advisories/GHSA-g5vf-v6wf-7w2r · Patch
• https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899 · Patch
• https://osv.dev/vulnerability/GHSA-g5vf-v6wf-7w2r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8929 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-142 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/tink/PYSEC-2020-142.yaml · Note
• https://t.me/cvenotify/124763 · Telegram Post