CVE-2023-43617

Name of the Vulnerable Software and Affected Versions Croc versions prior to 9.6.16

Description An issue was discovered in Croc where parts of a custom shared secret may be divulged to an untrusted Relay when composing a room name. This occurs when a custom shared secret is used.

Recommendations For Croc versions prior to 9.6.16, update to version 9.6.16 or later to resolve the issue. As a temporary workaround, consider avoiding the use of custom shared secrets until a patch is applied. Restrict access to untrusted Relays to minimize the risk of exploitation.