5.3

CVE-2020-8929: google llc tink Improper Handling of Unicode Encoding

CVSS: 5.3v3.1MediumAnalyzed
AliasesPYSEC-2020-142GHSA-g5vf-v6wf-7w2r
Published 19-10-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-8929 is a medium (CVSS 5.3) Improper Handling of Unicode Encoding vulnerability in google llc tink. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.7% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.46%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 19-10-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting deterministic AEAD with a single key, and rely on a unique ciphertext-per-plaintext.

CVSS metrics

5 scores · 3 sources · 3 versions

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

0.00 pp

From 0.46% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Com.google.crypto.tink1 product
  • tink< 1.5.0
Google1 product
Google llc1 product
  • tink≥ stable, < 1.5
PyPI1 product
  • tink< 93d839a5865b9d950dffdc9d0bc99b71280a8899 | < 1.5.0

4 vendors · 4 products

References

4 links