CVE-2017-15423: Medium severity Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

The attacker must be able to inspect SPAKE2 protocol traffic from an affected Chrome or Chromium BoringSSL implementation. No authentication or user interaction is required according to the supplied CVSS vector.

Q: What information could be exposed?

The flaw can leak low-order bits of SHA512(password). The provided information describes information disclosure only; it does not indicate integrity or availability impact.

Q: Which versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The data also identifies Chromium browser packages on Debian and Red Hat Enterprise Linux systems, but does not provide specific fixed package versions for those distributions.

Published Dec 7, 2017

Updated

An issue with spake implementation flaw was found in the BoringSSL component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=778101

External References:

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Other sources

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.

Affected Software

7 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<63.0.3239.84

63.0.3239.84

Google Chrome<63.0.3239.84

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Debian Debian Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 63.0.3239.84
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 63.0.3239.84

Event History

Dec 7, 2017

Data Sourced

via Red Hat·09:54 AM

DescriptionSeverityAffected Software

Aug 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must be able to inspect SPAKE2 protocol traffic from an affected Chrome or Chromium BoringSSL implementation. No authentication or user interaction is required according to the supplied CVSS vector.

What information could be exposed?

The flaw can leak low-order bits of SHA512(password). The provided information describes information disclosure only; it does not indicate integrity or availability impact.

Which versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The data also identifies Chromium browser packages on Debian and Red Hat Enterprise Linux systems, but does not provide specific fixed package versions for those distributions.

CVE-2017-15423: Medium severity Google Chrome vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Which versions are affected?