GitHub Advisoryadvisory · RubyGems

GHSA-4c4w-3q45-hp9j Aescrypt does not sufficiently use random values

HIGH Published 2017-10-24 Modified 2023-01-25 Official page ↗
Aliases
CVE-2013-7463
Ecosystem
RubyGems
Packages
aescrypt
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-330
Reviewed
2020-06-16

Affected packages

• RubyGems aescrypt: <= 1.0.0 (no fix yet)

Description

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.

Related

Alias · CVE (1)

  • CVE-2013-7463 The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which… vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References