search

bropat / eufy-security-ws

Small server wrapper around eufy-security-client library to access it via a WebSocket.
MIT License
184 stars 29 forks source link

CVE-2023-46809: Marvin attack on PKCS#1 padding #316

Closed Rubl80 closed 8 months ago

Rubl80 commented 8 months ago

Ask your question

In the eufy-security-ws add-on log, I can see this error/security warning: CVE-2023-46809: Marvin attack on PKCS#1 padding Wondering if anybody know if I should be worried or do anybody else experience the same behavior?

At the moment it does not affect the add-on and I have access to my eufy cameras in Home Assistant. But earlier the connection to the devices was broken, but a restart of the add-on fixed that, which was why I noticed this warning in the first place.

Logs from Eufy Security Add-on: s6-rc: info: service s6rc-oneshot-runner: starting s6-rc: info: service s6rc-oneshot-runner successfully started s6-rc: info: service fix-attrs: starting s6-rc: info: service fix-attrs successfully started s6-rc: info: service legacy-cont-init: starting s6-rc: info: service legacy-cont-init successfully started s6-rc: info: service legacy-services: starting s6-rc: info: service legacy-services successfully started SECURITY WARNING: Reverting CVE-2023-46809: Marvin attack on PKCS#1 padding

Mr-Wicket commented 8 months ago

getting the same thing. integration failed to load so I restarted the add-on. looked at the logs and have the same error. Google brought me here.

PhilippEngler commented 8 months ago

This is not an error, it is more an information and it is less bad than it sounds.

Due to the fact, that the PKCS#1 padding method is needed for decryption the received data, the security fix needs to be reverted. So, this message have no impact on running the client.