aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-377bc1b17c advisory.

    - Update the aes-gcm crate to version 0.10.3. Addresses CVE-2023-42811.
    - Rebuild dependent packages (firecracker) for aes-gcm v0.10.3.

    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42811

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-17bdd59177 advisory.

    - Update the aes-gcm crate to version 0.10.3. Addresses CVE-2023-42811.
    - Rebuild dependent packages (firecracker) for aes-gcm v0.10.3.

    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42811

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4060-1 advisory.

  - aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version     0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the     correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's     `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an     unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext     Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery.
    Version 0.10.3 contains a fix for this issue. (CVE-2023-42811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-98f44d1c4c advisory.

    - Update the aes-gcm crate to version 0.10.3. Addresses CVE-2023-42811.
    - Rebuild dependent packages (firecracker) for aes-gcm v0.10.3.

    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42811

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-bc40c7995e advisory.

    - Update the aes-gcm crate to version 0.10.3. Addresses CVE-2023-42811.
    - Rebuild dependent packages (firecracker) for aes-gcm v0.10.3.

    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42811

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194521	Fedora 40 : firecracker / rust-aes-gcm (2023-377bc1b17c)	Nessus	Fedora Local Security Checks	medium
185319	Fedora 39 : firecracker / rust-aes-gcm (2023-17bdd59177)	Nessus	Fedora Local Security Checks	medium
183017	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rage-encryption (SUSE-SU-2023:4060-1)	Nessus	SuSE Local Security Checks	medium
182427	Fedora 38 : firecracker / rust-aes-gcm (2023-98f44d1c4c)	Nessus	Fedora Local Security Checks	medium
182424	Fedora 37 : firecracker / rust-aes-gcm (2023-bc40c7995e)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-42811

medium

Tenable Plugins

medium

medium

medium

medium

medium