id: PYSEC-2020-142
details: A mis-handling of invalid unicode characters in the Java implementation of
  Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext,
  which result in the creation of a second ciphertext that can decrypt to the same
  plaintext. This can be a problem with encrypting deterministic AEAD with a single
  key, and rely on a unique ciphertext-per-plaintext.
affected:
- package:
    name: tink
    ecosystem: PyPI
    purl: pkg:pypi/tink
  ranges:
  - type: GIT
    repo: https://github.com/google/tink
    events:
    - introduced: "0"
    - fixed: 93d839a5865b9d950dffdc9d0bc99b71280a8899
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.5.0
  versions:
  - 1.4.0
references:
- type: ADVISORY
  url: https://github.com/google/tink/security/advisories/GHSA-g5vf-v6wf-7w2r
- type: FIX
  url: https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899
aliases:
- CVE-2020-8929
- GHSA-g5vf-v6wf-7w2r
modified: "2020-10-29T22:16:00Z"
published: "2020-10-19T13:15:00Z"