PT-2022-28120 · Mellium · Mellium.Im/Sasl

Published 2022-12-31 · Updated 2023-01-18 · CVE-2022-48195

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mellium mellium.im/sasl versions prior to 0.3.1

Description An issue was discovered in Mellium mellium.im/sasl when performing SCRAM-based SASL authentication. If the remote end advertises support for channel binding, no random nonce is generated, instead, the nonce is empty. This causes authentication to fail in the best case, but could lead to insufficient randomness being used during authentication if paired with a remote end that does not validate the length of the nonce.

Recommendations For versions prior to 0.3.1, update to version 0.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of SCRAM-based SASL authentication until a patch is available. Avoid using the nonce variable in the affected authentication process until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-48195

GHSA-GVFJ-FXX3-J323

GO-2023-1268

Affected Products

Mellium.Im/Sasl

References · 11

• https://osv.dev/vulnerability/GHSA-gvfj-fxx3-j323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48195 · Security Note
• https://mellium.im/cve/cve-2022-48195 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48195 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1268 · Vendor Advisory
• https://codeberg.org/mellium/sasl · Note
• https://t.me/cvenotify/41563 · Telegram Post
• https://pkg.go.dev/vuln/GO-2023-1268 · Note
• https://t.me/cvenotify/41048 · Telegram Post
• https://codeberg.org/mellium/sasl/commit/e6cbf681b247c4efa1477eaad2cc47a01707b732 · Note
• https://codeberg.org/mellium/sasl/releases/tag/v0.3.1 · Note