Inadequate Security in BoringSSL SPAKE2 of Google Chrome

CVE-2017-15423

Summary

A security flaw in the BoringSSL SPAKE2 implementation found in specific versions of Google Chrome enabled a remote attacker to exploit weaknesses in the encryption protocol. By analyzing protocol traffic, the attacker could potentially leak the low-order bits of the SHA512 hash of the user's password, raising significant concerns regarding data confidentiality and user security.

References