CVE-2021-4239: Noise vulnerable to denial of service
7.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.25832%
CWE
Published
12/28/2022
Updated
2/9/2023
KEV Status
No
Technology
Go
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/flynn/noise | go | < 1.0.0 | 1.0.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
- The commit diff explicitly shows the vulnerable Decrypt function in state.go was modified to fix nonce increment-on-failure behavior. 2. Vulnerability descriptions specifically mention Encrypt's nonce wrap-around issue, and the Go vulnerability report (GO-2022-0425) lists CipherState.Encrypt as an affected symbol. 3. Both functions manage nonce state - Encrypt through incremental counter, Decrypt through state synchronization - making them the logical points of failure for the described issues.