Bug 2270032 (CVE-2018-25099) - CVE-2018-25099 libtomcrypt: gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag
Summary: CVE-2018-25099 libtomcrypt: gcm_decrypt_verify() and chacha20poly1305_decrypt...
Keywords:
Status: NEW
Alias: CVE-2018-25099
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2270034 2270033 2270035 2270036
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-03-18 10:37 UTC by TEJ RATHI
Modified: 2024-03-18 11:09 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description TEJ RATHI 2024-03-18 10:37:58 UTC 
In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag.

https://github.com/DCIT/perl-CryptX/issues/47
https://github.com/libtom/libtomcrypt/pull/451
https://metacpan.org/dist/CryptX/changes
Comment 1 TEJ RATHI 2024-03-18 10:44:59 UTC 
Created libtomcrypt tracking bugs for this issue:

Affects: epel-all [bug 2270034]
Affects: fedora-all [bug 2270033]


Created perl-CryptX tracking bugs for this issue:

Affects: epel-all [bug 2270035]
Affects: fedora-all [bug 2270036]
Note You need to log in before you can comment on or make changes to this bug.