mellium.im / cve / cve-2022-48195
CVE-2022-48195
- Affected components:
- mellium.im/sasl
- Affected versions:
- v0.3.0
- Fixed in:
- v0.3.1
- Assigned CVE:
- CVE-2022-48195
If the remote end of a SCRAM based SASL authentication attempt advertises support for channel binding an empty nonce is used. This results in authentication failing on servers that verify the nonce length, but when paired with a server that does not properly verify the length it could result in insufficient randomness being used during authentication.
No known exploits or exploit chains take advantage of this issue.