-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/crypto | go | < 0.0.0-20190424203555-c05e17bb3b2d | 0.0.0-20190424203555-c05e17bb3b2d |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the Decode function's failure to properly handle Armor Headers as specified in RFC 4880. The commit c05e17bb3b2d shows critical validation was added to: 1) Reject non-Hash headers 2) Check for control characters 3) Validate header formatting 4) Verify message structure integrity. The original implementation's lack of these validations made header spoofing and message injection possible. The Decode function is directly responsible for parsing signed messages, making it the clear vulnerable entry point.
Ongoing coverage of React2Shell