MEDIUM5.1

GHSA-wvpv-ffcv-r6cw

Internal NCryptDecrypt method could be used externally from WindowsHello library.

Quick fix

GHSA-wvpv-ffcv-r6cw — HaemmerElectronics.SeppPenner.WindowsHello: upgrade to the fixed version with the command below.

dotnet add package HaemmerElectronics.SeppPenner.WindowsHello --version 1.0.4

Details

### Impact Every user of the library before version 1.0.4.

### Patches Patched in 1.0.4+.

### Workarounds None.

### References https://github.com/SeppPenner/WindowsHello/issues/3

### For more information It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/HaemmerElectronics.SeppPenner.WindowsHello

Introduced in: 0Fixed in: 1.0.4

Fixdotnet add package HaemmerElectronics.SeppPenner.WindowsHello --version 1.0.4