Headline
CVE-2022-48195: Mellium — CVE-2022-48195
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication to fail in the best case, but (if paired with a remote end that does not validate the length of the nonce) could lead to insufficient randomness being used during authentication.
******CVE-2022-48195**
Affected components:
- mellium.im/sasl
Affected versions:
- v0.3.0
Fixed in:
v0.3.1
Assigned CVE:
CVE-2022-48195
If the remote end of a SCRAM based SASL authentication attempt advertises support for channel binding an empty nonce is used. This results in authentication failing on servers that verify the nonce length, but when paired with a server that does not properly verify the length it could result in insufficient randomness being used during authentication.
No known exploits or exploit chains take advantage of this issue.
Related news
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication to fail in the best case, but (if paired with a remote end that does not validate the length of the nonce) could lead to insufficient randomness being used during authentication.