Skip to content

Internal NCryptDecrypt method could be used by other libraries as well.

Critical
SeppPenner published GHSA-wvpv-ffcv-r6cw Apr 14, 2020

Package

WindowsHello (C#)

Affected versions

<= 1.0.3

Patched versions

1.0.4+

Description

Impact

Every user of the library before version 1.0.4.

Patches

Patched in 1.0.4+.

Workarounds

None.

References

#3

For more information

It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.

Severity

Critical

CVE ID

CVE-2020-11005

Weaknesses

No CWEs