{"id":"CVE-2024-28864","aliases":["GHSA-rj29-j2g4-77q8"],"url":"https://o3.security/vulnerability/CVE-2024-28864","summary":"[TagAwareCipher] - Decryption Failure (Regex Match)","details":"### Impact\n\nVulnerability in **SecureProps** involves a regex failing to detect tags during decryption of encrypted data. \n\nThis occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. \n\nThe vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default).\n\n### Patches\n\nThe patch for the issue has been released. Users are advised to update to version **1.2.2**.\n\n### Workarounds\n\n**The main recommendation is to update to the latest version as there are no breaking changes.**\n\nIf that's not possible, you can use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. \n\nThis workaround is safe but may involve double encoding since `TagAwareCipher` uses `Base64Encoder` by default.\n \n### References\n\nReported issue: https://github.com/IlicMiljan/Secure-Props/issues/20\nPull request resolving bug: https://github.com/IlicMiljan/Secure-Props/pull/21\n","published":"2024-03-18T21:49:06.762Z","modified":"2026-08-12T03:51:22.505177927Z","cvss":{"score":2.6,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"ilicmiljan/secure-props","fixedVersion":"1.2.2"}],"fix":{"url":"https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627","label":"IlicMiljan/Secure-Props@ab7b561"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28864.json"},{"type":"ADVISORY","url":"https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28864"},{"type":"REPORT","url":"https://github.com/IlicMiljan/Secure-Props/issues/20"},{"type":"FIX","url":"https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627"},{"type":"FIX","url":"https://github.com/IlicMiljan/Secure-Props/pull/21"},{"type":"PACKAGE","url":"https://github.com/IlicMiljan/Secure-Props"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:22.505177927Z"}}