CVE-2021-22565 Insufficient Granularity of Access Control in GAEN Notification Server
An attacker can prematurely expire verification codes, preventing patients from uploading exposure data to the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22565?
CVE-2021-22565 is a medium-severity vulnerability in Google Exposure-notifications-verification-server, published on 9 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.
Weakness: CWE-284
Which versions are affected by CVE-2021-22565?
3 open source packages ship an affected version, including github.com/google/exposure-notifications-verification-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/google/exposure-notifications-verification-server Go | All versions | 1.1.2 |
github.com/google/exposure-notifications-verification-server Go | All versions | 1.1.2 |
github.com/google/exposure-notifications-verification-server Go | All versions | 1.1.2 |
Products include Google Exposure Notification Verification Server.
How do I fix CVE-2021-22565?
Upgrade github.com/google/exposure-notifications-verification-server to 1.1.2 or later.
Is CVE-2021-22565 being exploited?
There is no known exploitation of CVE-2021-22565 in the wild and no public exploit code.
Sources
Also known as GHSA-wx8q-rgfr-cf6v, GO-2022-0270.