Internal NCryptDecrypt method could be used externally from WindowsHello library.

TRUNG BÌNH 5.5CVE-2020-11005 · GHSA-wvpv-ffcv-r6cw · Công bố 14/04/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-11005 là lỗ hổng mức TRUNG BÌNH (CVSS 5.5) ảnh hưởng HaemmerElectronics.SeppPenner.WindowsHello, windowshello (windowshello project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.23%, cao hơn 14.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.0.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
HaemmerElectronics.SeppPenner.WindowsHello NuGet	`< 1.0.4`	`1.0.4`
windowshello windowshello_project	`< 1.0.4`	`1.0.4`

Mô tả

Impact

Every user of the library before version 1.0.4.

Patches

Patched in 1.0.4+.

Workarounds

None.

References

https://github.com/SeppPenner/WindowsHello/issues/3

For more information

It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.

Mô tả của NVD

The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again. This has been patched in version 1.0.4.