{"id":"GHSA-3wxm-m9m4-cprj","aliases":["GO-2022-0381"],"status":"published","title":"Import of incorrectly embargoed keys could cause early publication","description":"### Impact\n\nIf your installation is using the `export-importer` service, there is potential impact.\nIf your installation is not importing keys via the `export-importer` services, your installation is not impacted.\n\nIn versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.\n\nThis could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.\n\n### Patches\n\nThis is patched in `v0.18.3` and all versions `0.19.2` and later.\n\n### Workarounds\n\nEnsure that the servers you are importing export zip files from are not publishing keys too early. \n\n### References\n\nn/a\n\n### For more information\n\nIf you have any questions or comments about this advisory\n* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)\n* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-05-21T16:24:44Z","modified":"2026-03-03T04:50:11Z","fixes":[{"ecosystem":"Go","package":"github.com/google/exposure-notifications-server","fixed_in":["0.18.3","0.19.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/google/exposure-notifications-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/google/exposure-notifications-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0"},{"fixed":"0.19.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/exposure-notifications-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.18.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/exposure-notifications-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0.19.0"},{"fixed":"0.19.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/exposure-notifications-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.18.3"},{"introduced":"0.19.0"},{"fixed":"0.19.2"}]}]}],"references":[{"url":"https://github.com/google/exposure-notifications-server/security/advisories/GHSA-3wxm-m9m4-cprj","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3wxm-m9m4-cprj"}],"sources":{"ghsa":[{"id":"GHSA-3wxm-m9m4-cprj","title":"Import of incorrectly embargoed keys could cause early publication","description":"### Impact\n\nIf your installation is using the `export-importer` service, there is potential impact.\nIf your installation is not importing keys via the `export-importer` services, your installation is not impacted.\n\nIn versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.\n\nThis could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.\n\n### Patches\n\nThis is patched in `v0.18.3` and all versions `0.19.2` and later.\n\n### Workarounds\n\nEnsure that the servers you are importing export zip files from are not publishing keys too early. \n\n### References\n\nn/a\n\n### For more information\n\nIf you have any questions or comments about this advisory\n* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)\n* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)","status":"published","published":"2021-05-21T16:24:44Z","modified":"2023-01-09T05:04:33Z","updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-3wxm-m9m4-cprj","title":"Import of incorrectly embargoed keys could cause early publication","description":"### Impact\n\nIf your installation is using the `export-importer` service, there is potential impact.\nIf your installation is not importing keys via the `export-importer` services, your installation is not impacted.\n\nIn versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.\n\nThis could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.\n\n### Patches\n\nThis is patched in `v0.18.3` and all versions `0.19.2` and later.\n\n### Workarounds\n\nEnsure that the servers you are importing export zip files from are not publishing keys too early. \n\n### References\n\nn/a\n\n### For more information\n\nIf you have any questions or comments about this advisory\n* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)\n* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)","status":"published","published":"2021-05-21T16:24:44Z","modified":"2024-08-21T14:57:06.201348Z","updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"GO-2022-0381","title":"Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server","description":"Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server","status":"published","published":"2024-08-21T14:30:31Z","modified":"2026-03-03T04:50:11.298964Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}