Inadequate Security in BoringSSL SPAKE2 of Google Chrome
CVE-2017-15423
5.3MEDIUM
Key Information:
- Vendor
Google
- Vendor
- CVE Published:
- 28 August 2018
What is CVE-2017-15423?
A security flaw in the BoringSSL SPAKE2 implementation found in specific versions of Google Chrome enabled a remote attacker to exploit weaknesses in the encryption protocol. By analyzing protocol traffic, the attacker could potentially leak the low-order bits of the SHA512 hash of the user's password, raising significant concerns regarding data confidentiality and user security.
Affected Version(s)
Google Chrome prior to 63.0.3239.84 unknown Google Chrome prior to 63.0.3239.84 unknown