Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568. NOTE: The vendor disputes the existence of this potential issue in Android, stating "This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Android Bouncy Castle Crypto APIs for Java 信息泄露漏洞
Vulnerability Description
Android是美国谷歌（Google）公司和开放手持设备联盟（简称OHA）共同开发的一套以Linux为基础的开源操作系统。Bouncy Castle Crypto APIs for Java是一个用于Java平台且开源的轻量级密码包。 Android的Bouncy Castle Crypto APIs for Java中的asn1/cms/GCMParameters.java文件存在信息泄露漏洞，该漏洞源于程序使用不正确的AES-GCM-ICVlen值。攻击者可借助特制的应用程序利用该漏洞破坏机密保护机
CVSS Information
N/A
Vulnerability Type
N/A