Denial of Service in Tink-cc pre-2.1.3 via JsonKeysetReader
CVE-2024-4420 Published on May 21, 2024
Denial of Service in Tink-cc
There exists a Denial of service vulnerability in Tink-cc in versions prior to 2.1.3. * An adversary can crash binaries using the crypto::tink::JsonKeysetReader in tink-cc by providing an input that is not an encoded JSON object, but still a valid encoded JSON element, for example a number or an array. This will crash as Tink just assumes any valid JSON input will contain an object.
* An adversary can crash binaries using the crypto::tink::JsonKeysetReader in tink-cc by providing an input containing many nested JSON objects. This may result in a stack overflow.
We recommend upgrading to version 2.1.3 or above
Vulnerability Analysis
CVE-2024-4420 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an Output Sanitization Vulnerability?
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVE-2024-4420 has been classified to as an Output Sanitization vulnerability or weakness.
Products Associated with CVE-2024-4420
Want to know whenever a new CVE is published for Google Tink C? stack.watch will email you.
Affected Versions
Google Tink:- Version 2.0.0 and below 2.1.3 is affected.
- Before and including 1.7.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.