{"id":"GHSA-fwjg-cm92-j3hj","revision":null,"records":[{"revision":"3510cf793a62402ab287361fd7d7f40c","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0335","aliases":["GHSA-fwjg-cm92-j3hj"],"title":"Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key","description":"`mykey` implements MIKEY (RFC 3830) for SRTP key exchange. Pre-shared key mode\ntransmitted the TEK Generation Key (TGK) in the clear.\n\n`MikeyMessage::new_psk_init` built its KEMAC payload with `EncAlg::Null` and\nplaced the TGK in `enc_data` verbatim. Anyone able to read a PSK-Init message\ntherefore recovers the TGK — and so the SRTP master key — **without knowing the\npre-shared key**.\n\nThe transmitted value was never even used by the receiver: `complete_psk`\nre-derived the TGK from the pre-shared key and ignored `enc_data` entirely. The\nfield was write-only; it provided nothing and disclosed everything.\n\nA second consequence: the message authentication key was derived from the TGK\nrather than from the pre-shared key, so an attacker who read the TGK off the wire\ncould also forge a valid message MAC. Integrity was lost along with\nconfidentiality. That aspect is tracked separately as GHSA-xq78-wvcv-hqvj.\n\n## Exploitability\n\nA MIKEY message is normally distributed as an SDP `a=key-mgmt:mikey` attribute,\nwhich in AES67 and SMPTE ST 2110 deployments is typically announced over SAP\nmulticast. A passive listener on the media network recovers the session key with\nno active attack and no credentials.\n\nRFC 3830 §4.2.3 permits NULL encryption only where \"the underlying protocols can\nguarantee security\", and warns to use it with caution. An SDP file or a SAP\nannouncement is not such a channel.\n\n## The fix\n\nPre-shared key mode now follows RFC 3830 §3.1 as key *transport*: the initiator\ngenerates a random TGK, frames it as a Key data sub-payload (§6.13), and encrypts\nit with AES-CM (§4.2.3) under an encryption key and 112-bit salt derived from the\npre-shared key (§4.1.4). The message MAC is keyed from the pre-shared key and\nverified before anything is decrypted.\n\nThis changes the wire format, so both ends of an exchange must be upgraded\ntogether. The incompatibility is silent: an old peer and a new peer complete the\nexchange without error and then derive different SRTP keys.\n\n## Workarounds\n\nUse ephemeral Diffie-Hellman mode instead of pre-shared key mode, or carry the\nPSK-Init only over a channel that is already confidential and authenticated end\nto end.","state":0,"publishedAt":"2026-10-09T12:00:00+00:00","modifiedAt":"2026-10-12T09:15:02.4501061+00:00","affected":[{"ecosystem":"crates.io","name":"mykey","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"2.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/mykey","https://rustsec.org/advisories/RUSTSEC-2026-0335.html","https://github.com/waxspin/mykey/pull/25"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0335","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0335","identifiers":["RUSTSEC-2026-0335","GHSA-fwjg-cm92-j3hj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T11:25:04.0778179+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T11:25:04.0778179+00:00","lastSuccessAt":"2026-11-10T11:25:05.0136335+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:05.0136358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-7f63d5ae9ad1cf5d15daca54e2cb44cc953d9727a9c4dbe21f340d16ec79e07a","complete":true,"records":421929,"lastAttemptAt":"2026-11-10T11:21:40.8171583+00:00","lastSuccessAt":"2026-11-10T11:21:40.7840841+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:21:40.8171583+00:00","snapshotPublishedAt":"2026-11-10T10:23:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d438db76762e40e09fae683c91dc71f3","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T11:26:02.3053181+00:00","lastSuccessAt":"2026-11-10T11:26:02.298+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:26:02.298+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T11:25:04.0778179+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T11:25:04.0778179+00:00","lastSuccessAt":"2026-11-10T11:25:05.0144698+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:05.0144706+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c3b5116d0840469fb49189e776b1e7eb","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T11:25:33.4594859+00:00","lastSuccessAt":"2026-11-10T11:25:33.455+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T11:25:33.455+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T11:25:03.699196+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:03.699196+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T11:21:41.0754601+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:21:41.0754601+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T11:25:03.948442+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:03.948442+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-86f40cdda9ca36627f818d0cc8237a8a8c7c22cb687d6747a4ea12bded69e17e","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T11:25:02.6977972+00:00","lastSuccessAt":"2026-11-10T11:25:00.8551311+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:02.6977972+00:00","snapshotPublishedAt":"2026-11-10T11:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}