CVE-2020-8929: 
Java vulnerability analysis and mitigation

A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allowed attackers to change the ID part of a ciphertext, which could result in the creation of a second ciphertext that would decrypt to the same plaintext. The vulnerability was discovered and disclosed in October 2020 and affects all versions of Tink Java implementation up to version 1.4 (NVD, GitHub Advisory).

The vulnerability stems from Tink's use of a hash map indexed by unicode strings instead of byte arrays for prefix lookup. When invalid Unicode characters were encountered, they would be replaced by U+FFFD due to Java API's default behavior. This meant that different byte sequences could result in the same hash table key, allowing attackers to exchange one invalid byte sequence for another. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability primarily affects ciphertext integrity, particularly in cases where deterministic AEAD encryption is used with a single key and there is reliance on having only a single valid ciphertext per plaintext. Importantly, the vulnerability does not compromise confidentiality or plaintext integrity (GitHub Advisory).

The vulnerability was fixed in Tink version 1.5. For users unable to upgrade, the only workaround is to backport the fixing pull request. The fix involves changing how the prefix lookup is handled, using byte arrays instead of unicode strings (GitHub Advisory, GitHub Commit).