CVEvulnerability

CVE-2013-7463

7.5 HIGH Published 2017-04-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-04-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-330

Description

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.

Affected configurations

• aescrypt project aescrypt (<= 1.0.0)

Related

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References