Mellium

mellium.im / cve / cve-2022-48195

CVE-2022-48195

Affected components:
  • mellium.im/sasl
Affected versions:
  • v0.3.0
Fixed in:
    v0.3.1
Assigned CVE:
CVE-2022-48195

If the remote end of a SCRAM based SASL authentication attempt advertises support for channel binding an empty nonce is used. This results in authentication failing on servers that verify the nonce length, but when paired with a server that does not properly verify the length it could result in insufficient randomness being used during authentication.

No known exploits or exploit chains take advantage of this issue.

References