medium5.1
CVE-2020-11005
Internal NCryptDecrypt method could be used externally from WindowsHello library.
Impact
### Impact Every user of the library before version 1.0.4. ### Patches Patched in 1.0.4+. ### Workarounds None. ### References https://github.com/SeppPenner/WindowsHello/issues/3 ### For more information It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | HaemmerElectronics.SeppPenner.WindowsHello | < 1.0.4 | 1.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Windowshello Project | Windowshello | before 1.0.4 |