Medium, CVSS 6.3GoPublished
arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS
GHSA-rc6v-5rmx-w5mv
- Affected
- Go github.com/arnika-project/arnika <= 1.0.0
- Fixed in
- 1.0.1· Vendor fix available
- Issue
- Three medium-severity issues in arnika affecting the UDP key-rotation protocol, PQC key file handling, and KMS TLS client. All require specific preconditions to exploit and do not allow direct code execution or immediate key extraction. A self-contained PoC is attached. Details 1) ACK timestamp not validated: udpserver.go:185 udpClient() verifies HMAC and packet type but never checks ackPkt.Timestamp. A MITM can capture one ACK, drop all subsequent DATA packets, and replay the stale ACK indefinitely. Primary advances PSK each rotation, backup stays on key 1, tunnel breaks. No PSK knowledge needed. The server side already has this check, the client does not. Fix: mirror the timestamp check already present on the server side. 2) Empty PQC key file silently accepted: repositories/pqc.go:29 os.ReadFile follows symlinks. Empty file to base64.Decode("") = []byte{}, nil. HKDF runs on the QKD key alone while arnika logs [OK] HKDF derivation completed for QKD+PQC key. Requires write…
Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.