GitHub Advisoryadvisory · PyPI
GHSA-39vm-p9mr-4r27 Beaker Sensitive Information Disclosure vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2012-3458
- Ecosystem
- PyPI
- Packages
- beaker
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-326
- Reviewed
- 2024-05-01
Affected packages
• PyPI beaker: < 1.6.4 → fixed in 1.6.4
Description
Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
Related
Alias · CVE (1)
- CVE-2012-3458 Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain… vulnerability
Weakness · CWE (1)
- CWE-326 Inadequate Encryption Strength weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-3458 advisory
- https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5 web
- https://bugzilla.redhat.com/show_bug.cgi?id=809267 web
- https://github.com/bbangert/beaker package
- https://github.com/pypa/advisory-database/tree/main/vulns/beaker/PYSEC-2012-1.yaml web
- https://web.archive.org/web/20140724164516/http://secunia.com/advisories/50226 web
- https://web.archive.org/web/20140725025612/http://secunia.com/advisories/50520 web
- http://www.debian.org/security/2012/dsa-2541 web
- http://www.openwall.com/lists/oss-security/2012/08/13/10 web