GitHub Advisoryadvisory · Packagist

GHSA-h7qw-mxrm-c6h2 Unauthenticated crypto and weak IV in Magento\Framework\Encryption

HIGH Published 2019-11-20 Modified 2025-02-10 Official page ↗
Aliases
CVE-2016-6485
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-327
Reviewed
2019-11-19

Affected packages

• Packagist magento/community-edition: >= 2.0, < 2.2.6 → fixed in 2.2.6 • Packagist magento/project-community-edition: >= 2.0, <= 2.0.2 (no fix yet)

Description

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.

Related

Alias · CVE (1)

  • CVE-2016-6485 The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the… vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References