CVE-2025-68113

{"id": "CVE-2025-68113", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68113", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T21:13:57.662095Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "altcha-org", "product": "altcha-lib", "versions": [{"status": "affected", "version": "< 1.4.1"}]}]}], "published": "2025-12-16T01:15:53.383", "references": [{"url": "https://github.com/altcha-org/altcha-lib-ex/commit/09b2bad466ad0338a5b24245380950ea9918333e", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib-rb/commit/4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-115"}, {"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions, which include version 1.0.0 of the altcha Golang package, version 1.0.0 of the altcha Rubygem, version 1.0.0 of the altcha pip package, version 1.0.0 of the altcha Erlang package, version 1.4.1 of the altcha-lib npm package, version 1.3.1 of the altcha-org/altcha Composer package, and version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `<salt>?expires=<time>&`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator."}, {"lang": "es", "value": "ALTCHA es un software que prioriza la privacidad para la protecci\u00f3n contra captcha y bots. Una falla de enlace sem\u00e1ntico criptogr\u00e1fico en las bibliotecas de ALTCHA permite el empalme de la carga \u00fatil del desaf\u00edo, lo que puede habilitar ataques de repetici\u00f3n. La firma HMAC no vincula de forma inequ\u00edvoca los par\u00e1metros del desaf\u00edo al nonce, permitiendo a un atacante reinterpretar una presentaci\u00f3n v\u00e1lida de prueba de trabajo con un valor de expiraci\u00f3n modificado. Esto puede permitir que los desaf\u00edos resueltos previamente se reutilicen m\u00e1s all\u00e1 de su vida \u00fatil prevista, dependiendo del manejo de repeticiones del lado del servidor y las suposiciones de despliegue. La vulnerabilidad impacta principalmente los mecanismos de prevenci\u00f3n de abuso, como la limitaci\u00f3n de velocidad y la mitigaci\u00f3n de bots. No afecta directamente la confidencialidad o integridad de los datos. Este problema ha sido abordado al aplicar una separaci\u00f3n sem\u00e1ntica expl\u00edcita entre los par\u00e1metros del desaf\u00edo y el nonce durante el c\u00e1lculo de HMAC. Se aconseja a los usuarios actualizar a versiones parcheadas, que incluyen la versi\u00f3n 1.0.0 del paquete altcha Golang, la versi\u00f3n 1.0.0 del Rubygem altcha, la versi\u00f3n 1.0.0 del paquete pip altcha, la versi\u00f3n 1.0.0 del paquete altcha Erlang, la versi\u00f3n 1.4.1 del paquete npm altcha-lib, la versi\u00f3n 1.3.1 del paquete Composer altcha-org/altcha y la versi\u00f3n 1.3.0 del paquete Maven org.altcha:altcha. Como mitigaci\u00f3n, las implementaciones pueden a\u00f1adir un delimitador al final del valor 'salt' antes del c\u00e1lculo de HMAC (por ejemplo, <salt>?expires=<time>&). Esto previene la ambig\u00fcedad entre los par\u00e1metros y el nonce y es compatible con versiones anteriores de implementaciones existentes, ya que el delimitador se trata como un separador de par\u00e1metros URL est\u00e1ndar."}], "lastModified": "2026-10-07T19:10:00.160", "sourceIdentifier": "security-advisories@github.com"}