PT-2024-31032 · Google · Tink-Cc

Juergw · Published 2024-05-21 · Updated 2025-06-05 · CVE-2024-4420

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tink-cc versions prior to 2.1.3

Description The issue is related to a Denial of service vulnerability. An adversary can crash binaries using the crypto::tink::JsonKeysetReader in Tink-cc by providing an input that is not an encoded JSON object, but still a valid encoded JSON element, for example a number or an array. This will crash as Tink just assumes any valid JSON input will contain an object. Additionally, an adversary can crash binaries by providing an input containing many nested JSON objects, which may result in a stack overflow.

Recommendations We recommend upgrading to version 2.1.3 or above. As a temporary workaround, consider restricting the use of the crypto::tink::JsonKeysetReader function until a patch is available. Avoid using inputs that are not encoded JSON objects or contain many nested JSON objects in the affected API endpoint until the issue is resolved.

Fix

DoS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2024-4420

Affected Products

Tink-Cc

References · 7

• https://github.com/tink-crypto/tink-cc/issues/4 · Patch
• https://osv.dev/vulnerability/CVE-2024-4420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4420 · Security Note
• https://t.me/cvenotify/80534 · Telegram Post
• https://twitter.com/CVEnew/status/1792894194840715528 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1792927365166665877 · Twitter Post
• https://t.me/cvenotify/124764 · Telegram Post