CVE-2023-34758 - Vulnerability Details - OpenCVE

Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Bishopfox	Sliver

Configuration 1 [-]

cpe:2.3:a:bishopfox:sliver:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/BishopFox/sliver/releases/tag/v1.5.40
https://github.com/advisories/GHSA-8jxm-xp43-qh3q
https://github.com/tangent65536/Slivjacker
https://www.chtsecurity.com/news/04f41dcc-1851-463c-93bc-551323ad8091

History

Wed, 02 Oct 2024 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-28T00:00:00

Updated: 2024-10-02T16:29:43.246Z

Reserved: 2023-06-07T00:00:00

Link: CVE-2023-34758

Vulnrichment

Updated: 2024-08-02T16:17:04.127Z

NVD

Status : Modified

Published: 2023-08-28T12:15:09.007

Modified: 2024-11-21T08:07:34.370

Link: CVE-2023-34758

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bishopfox:sliver:*:*:*:*:*:*:*:*", "matchCriteriaId": "11847E81-39F7-4881-A036-D4E675D4AFE2", "versionEndExcluding": "1.5.40", "versionStartIncluding": "1.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses."}, {"lang": "es", "value": "Sliver desde la versi\u00f3n 1.5.x hasta la versi\u00f3n 1.5.39 tiene una implementaci\u00f3n criptogr\u00e1fica incorrecta, que permite a los atacantes ejecutar un ataque man-in-the-middle a trav\u00e9s de respuestas interceptadas y manipuladas."}], "id": "CVE-2023-34758", "lastModified": "2024-11-21T08:07:34.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-28T12:15:09.007", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/BishopFox/sliver/releases/tag/v1.5.40"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/advisories/GHSA-8jxm-xp43-qh3q"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://github.com/tangent65536/Slivjacker"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.chtsecurity.com/news/04f41dcc-1851-463c-93bc-551323ad8091"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/BishopFox/sliver/releases/tag/v1.5.40"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/advisories/GHSA-8jxm-xp43-qh3q"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://github.com/tangent65536/Slivjacker"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.chtsecurity.com/news/04f41dcc-1851-463c-93bc-551323ad8091"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}], "source": "nvd@nist.gov", "type": "Primary"}]}