GHSA-wvpv-ffcv-r6cwMediumCVSS 5.1

Internal NCryptDecrypt method could be used externally from WindowsHello library.

Published
April 14, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-11005 →

📋 Description

Impact

Every user of the library before version 1.0.4.

Patches

Patched in 1.0.4+.

Workarounds

None.

References

https://github.com/SeppPenner/WindowsHello/issues/3

For more information

It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.

🎯 Affected products1

  • nuget/HaemmerElectronics.SeppPenner.WindowsHello:< 1.0.4

🔗 References (4)