{"id":"CVE-2023-42811","aliases":["EUVD-2023-2411","GHSA-423w-p2w9-r7vq","RUSTSEC-2023-0096","SUSE-SU-2023:4060-1","openSUSE-SU-2024:13315-1"],"status":"published","title":"AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0023,"percentile":0.13931,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2023-09-22T15:19:15Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"crates.io","package":"aes-gcm","fixed_in":["0.10.3"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"rage-encryption","fixed_in":["0.9.2+0-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"rage-encryption","fixed_in":["0.9.2+0-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"shadowsocks-rust","fixed_in":["1.16.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"aes-gcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0"},{"last_affected":"0.10.2"},{"fixed":"0.10.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"aes-gcm","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"0.10.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"aes-gcm","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"0.10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"rage-encryption","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2+0-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rage-encryption","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2+0-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"shadowsocks-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-1.1"}]}]}],"products":[{"vendor":"aes-gcm_project","product":"aes-gcm"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"rustcrypto","product":"aeads"}],"references":[{"url":"https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU/","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF/","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K/","tags":["x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42811","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0096.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-423w-p2w9-r7vq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42811.json","tags":["advisory"]},{"url":"https://github.com/RustCrypto/AEADs","tags":["package"]},{"url":"https://crates.io/crates/aes-gcm","tags":["package"]},{"url":"https://github.com/RustCrypto/AEADs/pull/551","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234060-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215657","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42811","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-42811","title":"AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","status":"published","published":"2023-09-22T15:19:15.445Z","modified":"2025-06-18T14:22:56.534Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2023-2411","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","status":"published","published":"2023-09-22T15:19:15Z","modified":"2025-06-18T14:22:56Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:20.01453Z"}],"ghsa":[{"id":"GHSA-423w-p2w9-r7vq","title":"AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"### Summary\nIn the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. \n\n### Impact\nIf a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery.\n\n### Details\nAs seen in the implementation of [decrypt_in_place_detached](https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309) for AES GCM, if the tag verification fails, an error is returned. Because the decryption of the ciphertext is done in place, the plaintext contents are now exposed via `buffer`. \n\nThis should ideally not be the case - as noted in page 17 of[ NIST's publication _Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC_](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf): \n_In Step 8, the result of Step 7 is compared with the authentication tag that was received as an input: if they are identical, then the plaintext is returned; otherwise,FAIL is returned._\n\nThis is seems correctly addressed in the [AES GCM SIV implementation](https://docs.rs/aes-gcm-siv/latest/src/aes_gcm_siv/lib.rs.html#307), where the decrypted buffer is encrypted again before the error is returned - this fix is straightforward to implement in AES GCM. To ensure that these types of cases are covered during testing, it would be valuable to add test cases like [23, 24 ](https://github.com/google/wycheproof/blob/master/testvectors/aes_gcm_test.json#L288)etc from [project wycheproof ](https://github.com/google/wycheproof)to ensure that when a bad tag is used, there is an error on decryption _**and**_ that the plaintext value is not exposed. \n\n### PoC\nTo reproduce this issue, I'm using [test case 23](https://github.com/google/wycheproof/blob/master/testvectors/aes_gcm_test.json#L288) from project wycheproof. \n```rust\n    let key = GenericArray::from_slice(\u0026hex!(\"000102030405060708090a0b0c0d0e0f\"));\n    let nonce = GenericArray::from_slice(\u0026hex!(\"505152535455565758595a5b\"));\n    let tag = GenericArray::from_slice(\u0026hex!(\"d9847dbc326a06e988c77ad3863e6083\")); // bad tag\n    let mut ct = hex!(\"eb156d081ed6b6b55f4612f021d87b39\");\n    let msg = hex!(\"202122232425262728292a2b2c2d2e2f\");\n    let aad = hex!(\"\");\n    let cipher = Aes128Gcm::new(\u0026key);\n    let _plaintext = cipher.decrypt_in_place_detached(\u0026nonce, \u0026aad, \u0026mut ct, \u0026tag);\n    assert_eq!(ct, msg);\n```","status":"published","published":"2023-09-22T16:11:47Z","modified":"2025-12-31T22:00:24Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:39:15.106458Z"}],"nvd":[{"id":"CVE-2023-42811","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","status":"published","published":"2023-09-22T16:15:10.583Z","modified":"2026-06-17T06:24:34.02Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"CVE-2023-42811","title":"AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue.","status":"published","published":"2023-09-22T15:19:15.445Z","modified":"2026-10-28T02:30:59.743741835Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-423w-p2w9-r7vq","title":"AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"### Summary\nIn the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. \n\n### Impact\nIf a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery.\n\n### Details\nAs seen in the implementation of [decrypt_in_place_detached](https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309) for AES GCM, if the tag verification fails, an error is returned. Because the decryption of the ciphertext is done in place, the plaintext contents are now exposed via `buffer`. \n\nThis should ideally not be the case - as noted in page 17 of[ NIST's publication _Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC_](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf): \n_In Step 8, the result of Step 7 is compared with the authentication tag that was received as an input: if they are identical, then the plaintext is returned; otherwise,FAIL is returned._\n\nThis is seems correctly addressed in the [AES GCM SIV implementation](https://docs.rs/aes-gcm-siv/latest/src/aes_gcm_siv/lib.rs.html#307), where the decrypted buffer is encrypted again before the error is returned - this fix is straightforward to implement in AES GCM. To ensure that these types of cases are covered during testing, it would be valuable to add test cases like [23, 24 ](https://github.com/google/wycheproof/blob/master/testvectors/aes_gcm_test.json#L288)etc from [project wycheproof ](https://github.com/google/wycheproof)to ensure that when a bad tag is used, there is an error on decryption _**and**_ that the plaintext value is not exposed. \n\n### PoC\nTo reproduce this issue, I'm using [test case 23](https://github.com/google/wycheproof/blob/master/testvectors/aes_gcm_test.json#L288) from project wycheproof. \n```rust\n    let key = GenericArray::from_slice(\u0026hex!(\"000102030405060708090a0b0c0d0e0f\"));\n    let nonce = GenericArray::from_slice(\u0026hex!(\"505152535455565758595a5b\"));\n    let tag = GenericArray::from_slice(\u0026hex!(\"d9847dbc326a06e988c77ad3863e6083\")); // bad tag\n    let mut ct = hex!(\"eb156d081ed6b6b55f4612f021d87b39\");\n    let msg = hex!(\"202122232425262728292a2b2c2d2e2f\");\n    let aad = hex!(\"\");\n    let cipher = Aes128Gcm::new(\u0026key);\n    let _plaintext = cipher.decrypt_in_place_detached(\u0026nonce, \u0026aad, \u0026mut ct, \u0026tag);\n    assert_eq!(ct, msg);\n```","status":"published","published":"2023-09-22T16:11:47Z","modified":"2026-02-03T03:15:54.086216Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"RUSTSEC-2023-0096","title":"Plaintext exposed in decrypt_in_place_detached even on tag verification failure","description":"## Summary\n\nIn the AES GCM implementation of decrypt_in_place_detached,\nthe decrypted ciphertext (i.e. the correct plaintext) is\nexposed even if tag verification fails.\n\n## Impact\n\nIf a program using the aes-gcm crate's decrypt_in_place*\nAPIs accesses the buffer after decryption failure, it will\ncontain a decryption of an unauthenticated input. Depending\non the specific nature of the program this may enable\nChosen Ciphertext Attacks (CCAs) which can cause a\ncatastrophic breakage of the cipher including full\nplaintext recovery.\n\n## Details\n\nAs seen in the implementation of decrypt_in_place_detached for\nAES GCM, if the tag verification fails, an error is returned.\nBecause the decryption of the ciphertext is done in place,\nthe plaintext contents are now exposed via buffer.\n\nThis should ideally not be the case - as noted in page 17 of\nNIST's publication Recommendation for Block Cipher Modes of\nOperation: Galois/Counter Mode (GCM) and GMAC:\n\nIn Step 8, the result of Step 7 is compared with the\nauthentication tag that was received as an input: if\nthey are identical, then the plaintext is returned;\notherwise,FAIL is returned.\n\nThis is seems correctly addressed in the AES GCM SIV\nimplementation, where the decrypted buffer is encrypted\nagain before the error is returned - this fix is\nstraightforward to implement in AES GCM. To ensure that\nthese types of cases are covered during testing, it\nwould be valuable to add test cases like 23, 24 etc\nfrom project wycheproof to ensure that when a bad tag\nis used, there is an error on decryption and that the\nplaintext value is not exposed.\n\n## PoC\n\nTo reproduce this issue, I'm using test case 23 from\nproject wycheproof.\n\n```\n    let key = GenericArray::from_slice(\u0026hex!(\"000102030405060708090a0b0c0d0e0f\"));\n    let nonce = GenericArray::from_slice(\u0026hex!(\"505152535455565758595a5b\"));\n    let tag = GenericArray::from_slice(\u0026hex!(\"d9847dbc326a06e988c77ad3863e6083\")); // bad tag\n    let mut ct = hex!(\"eb156d081ed6b6b55f4612f021d87b39\");\n    let msg = hex!(\"202122232425262728292a2b2c2d2e2f\");\n    let aad = hex!(\"\");\n    let cipher = Aes128Gcm::new(\u0026key);\n    let _plaintext = cipher.decrypt_in_place_detached(\u0026nonce, \u0026aad, \u0026mut ct, \u0026tag);\n    assert_eq!(ct, msg);\n```","status":"published","published":"2023-11-22T12:00:00Z","modified":"2026-10-12T18:00:05.861248756Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"openSUSE-SU-2024:13315-1","title":"shadowsocks-rust-1.16.2-1.1 on GA media","description":"These are all security issues fixed in the shadowsocks-rust-1.16.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:32.315619Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:4060-1","title":"Security update for rage-encryption","description":"This update for rage-encryption fixes the following issues:\n\n -CVE-2023-42811: chosen ciphertext attack possible against aes-gcm (bsc#1215657)\n\n  * update vendor.tar.zst to contain aes-gcm \u003e= 0.10.3\n\n- Update to version 0.9.2+0:\n\n  * CI: Ensure `apt` repository is up-to-date before installing build deps\n  * CI: Build Linux releases using `ubuntu-20.04` runner\n  * CI: Remove most uses of `actions-rs` actions\n\n- Update to version 0.9.2+0:\n\n  * Fix changelog bugs and add missing entry\n  * Document `PINENTRY_PROGRAM` environment variable\n  * age: Add `Decryptor::new_async_buffered`\n  * age: `impl AsyncBufRead for ArmoredReader`\n  * Pre-initialize vectors when the capacity is known, or use arrays\n  * Use `PINENTRY_PROGRAM` as environment variable for `pinentry`\n  * Document why `impl AsyncWrite for StreamWriter` doesn't loop indefinitely\n  * cargo update\n  * cargo vet prune\n  * Migrate to `cargo-vet 0.7`\n  * build(deps): bump svenstaro/upload-release-action from 2.5.0 to 2.6.1\n  * Correct spelling in documentation\n  * build(deps): bump codecov/codecov-action from 3.1.1 to 3.1.4\n  * StreamWriter AsyncWrite: fix usage with futures::io::copy()\n  * rage: Use `Decryptor::new_buffered`\n  * age: Add `Decryptor::new_buffered`\n  * age: `impl BufRead for ArmoredReader`\n  * Update Homebrew formula to v0.9.1\n  * feat/pinentry: Use env var to define pinentry binary\n\n- Update to version 0.9.1+0:\n\n  * ssh: Fix parsing of OpenSSH private key format\n  * ssh: Support `aes256-gcm@openssh.com` ciphers for encrypted keys\n  * ssh: Add `aes256-gcm@openssh.com` cipher to test cases\n  * ssh: Extract common key material derivation logic for encrypted keys\n  * ssh: Use associated constants for key and IV sizes\n  * ssh: Add test cases for encrypted keys\n- Add shell completions for fish and zsh.\n","status":"published","published":"2023-10-12T08:05:57Z","modified":"2026-02-04T04:15:58.724286Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}