{"id":"GHSA-3wxm-m9m4-cprj","aliases":["GO-2022-0381"],"url":"https://o3.security/vulnerability/GHSA-3wxm-m9m4-cprj","summary":"Import of incorrectly embargoed keys could cause early publication","details":"### Impact\n\nIf your installation is using the `export-importer` service, there is potential impact.\nIf your installation is not importing keys via the `export-importer` services, your installation is not impacted.\n\nIn versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.\n\nThis could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.\n\n### Patches\n\nThis is patched in `v0.18.3` and all versions `0.19.2` and later.\n\n### Workarounds\n\nEnsure that the servers you are importing export zip files from are not publishing keys too early. \n\n### References\n\nn/a\n\n### For more information\n\nIf you have any questions or comments about this advisory\n* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)\n* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)","published":"2021-05-21T16:24:44Z","modified":"2024-08-21T14:57:06.201348Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/google/exposure-notifications-server","fixedVersion":"0.18.3"},{"ecosystem":"Go","name":"github.com/google/exposure-notifications-server","fixedVersion":"0.19.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/google/exposure-notifications-server/security/advisories/GHSA-3wxm-m9m4-cprj"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-08-21T14:57:06.201348Z"}}