{"id":"GHSA-xq78-wvcv-hqvj","revision":null,"records":[{"revision":"2d6c1957d0934619855ab8b61e50800b","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0336","aliases":["GHSA-xq78-wvcv-hqvj"],"title":"MIKEY message MAC is never verified on receive, so forged messages are accepted","description":"`mykey` implements MIKEY (RFC 3830) for SRTP key exchange. No receive path\nverified the MIKEY message authentication code.\n\n`crypto::verify_mac` existed and was correct, but it was called only from unit\ntests — neither `MikeyMessage::from_bytes` nor `MikeyMessage::complete_psk`\ninvoked it.\n\n`new_psk_init` computed an HMAC-SHA-1-160 over the serialized message and\nappended it, so the tag was present on the wire and looked like integrity\nprotection. It was decorative: a receiver accepted any message regardless of\nwhether the MAC was correct, wrong, or absent.\n\n## Consequences\n\n- An attacker able to inject or modify MIKEY messages in transit faced no\n  integrity check. Modified RAND, SSRC or security-policy payloads were accepted\n  silently. Note that this does not require a man-in-the-middle position: since\n  nothing was checked, a wholly forged PSK-Init was accepted.\n- Pre-shared key mode therefore provided no mutual authentication, despite the\n  documentation claiming that it did. Possession of the pre-shared key was never\n  actually proven by either party.\n- Replayed init messages were not rejected.\n\nThe practical severity was bounded by GHSA-fwjg-cm92-j3hj (cleartext TGK), which\nalready let a passive observer recover the key material outright without needing\nto forge anything.\n\n## The fix\n\n`complete_psk` now verifies the message MAC **before** any decryption, so a\nmessage that fails authentication yields no key material at all. A `MacAlg::Null`\npayload, an absent MAC and a truncated MAC are each refused rather than treated\nas \"no check required\".\n\nThe authentication key is now derived from the pre-shared key per RFC 3830 §4.1.4\nrather than from the TGK — a prerequisite, since verifying against a TGK-derived\nkey would have been circular while the TGK travelled in the message itself.\nOptional §6.9 verification messages were also added, giving the exchange genuine\nmutual authentication.\n\nReplay protection is still absent: a captured PSK-Init can be replayed and will\nbe accepted, because the optional COUNTER timestamp is emitted rather than a\nmandatory NTP type and no record of seen timestamps or RAND values is kept. That\ngap is tracked at <https://github.com/waxspin/mykey/issues/24> and is not covered\nby this advisory.\n\n## Workarounds\n\nTreat parsed MIKEY messages as unauthenticated input: do not rely on pre-shared\nkey mode for peer authentication or message integrity, and carry it over a\ntransport that provides both.","state":0,"publishedAt":"2026-10-09T12:00:00+00:00","modifiedAt":"2026-10-12T09:15:02.4594405+00:00","affected":[{"ecosystem":"crates.io","name":"mykey","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"2.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/mykey","https://rustsec.org/advisories/RUSTSEC-2026-0336.html","https://github.com/waxspin/mykey/pull/25"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0336","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0336","identifiers":["RUSTSEC-2026-0336","GHSA-xq78-wvcv-hqvj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T11:25:04.0778179+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T11:25:04.0778179+00:00","lastSuccessAt":"2026-11-10T11:25:05.0136335+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:05.0136358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-7f63d5ae9ad1cf5d15daca54e2cb44cc953d9727a9c4dbe21f340d16ec79e07a","complete":true,"records":421929,"lastAttemptAt":"2026-11-10T11:21:40.8171583+00:00","lastSuccessAt":"2026-11-10T11:21:40.7840841+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:21:40.8171583+00:00","snapshotPublishedAt":"2026-11-10T10:23:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d438db76762e40e09fae683c91dc71f3","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T11:26:02.3053181+00:00","lastSuccessAt":"2026-11-10T11:26:02.298+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:26:02.298+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T11:25:04.0778179+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T11:25:04.0778179+00:00","lastSuccessAt":"2026-11-10T11:25:05.0144698+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:05.0144706+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c3b5116d0840469fb49189e776b1e7eb","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T11:25:33.4594859+00:00","lastSuccessAt":"2026-11-10T11:25:33.455+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T11:25:33.455+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T11:25:03.699196+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:03.699196+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T11:21:41.0754601+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:21:41.0754601+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T11:25:03.948442+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:03.948442+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-86f40cdda9ca36627f818d0cc8237a8a8c7c22cb687d6747a4ea12bded69e17e","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T11:25:02.6977972+00:00","lastSuccessAt":"2026-11-10T11:25:00.8551311+00:00","error":null,"lastVerifiedAt":"2026-11-10T11:25:02.6977972+00:00","snapshotPublishedAt":"2026-11-10T11:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}