CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Base

The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.

Attackers might be able to modify the message and spoof the endpoint by interfering with the data as it crosses the network or by redirecting the connection to a system under their control.

Consequences

Integrity, Confidentiality: Gain Privileges or Assume Identity

Recent advisories

GHSA-qpw4-5x99-6vjp — golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

All advisories for CWE-924

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor