-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/crypto | go | < 0.0.0-20190320223903-b7391e95e576 | 0.0.0-20190320223903-b7391e95e576 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from the amd64-specific assembly implementation of Salsa20's XORKeyStream() function. The CVE description explicitly mentions the amd64 implementation's failure when counters exceed 32 bits. The commit b7391e95 shows modifications to the salsa20_amd64.s assembly file to fix counter handling. The GitHub issue #30965 confirms this affects the XORKeyStream implementation in the amd64 assembly code. The vulnerability manifests specifically in the low-level counter management logic that wasn't properly handling 64-bit values, leading to keystream repetition.
Ongoing coverage of React2Shell