| शीर्षक | Cesanta Mongoose Embedded Web Server 7.20 Improper Verification of Cryptographic Signature |
|---|
| विवरण | The mg_chacha20_poly1305_decrypt() function in /src/tls_chacha20.c never computes or verifies the Poly1305 authentication tag during decryption, completely bypassing the authentication guarantee of the AEAD cipher. Because ChaCha20 is a stream cipher, this allows a man-in-the-middle attacker to perform bit-flipping attacks on any TLS record, thus modifying encrypted data in transit with byte-level precision, and the Mongoose server will accept the tampered record as authentic. This renders TLS connections using the built-in TLS implementation completely unauthenticated.
Vendor recognizes that this is a serious vulnerability but is incapable or unwilling to fix it. |
|---|
| स्रोत | ⚠️ https://github.com/dwBruijn/CVEs/blob/main/Mongoose/ChaCha20Poly1305.md |
|---|
| उपयोगकर्ता | dwbruijn (UID 93926) |
|---|
| सबमिशन | 12/02/2026 08:26 AM (8 महीनों पहले) |
|---|
| संयम | 22/02/2026 08:57 AM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347335 [Cesanta Mongoose तक 7.20 Poly1305 Authentication Tag /src/tls_chacha20.c mg_chacha20_poly1305_decrypt कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|