PT-2017-9351

CVE-2016-7798

Publicado

2016-10-13

Atualizado

2020-11-05

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openssl gem for Ruby (affected versions not specified)

Description The issue arises when the initialization vector (IV) is set before the key in GCM Mode (aes-*-gcm), allowing context-dependent attackers to bypass the encryption protection mechanism. This makes it easier for attackers to exploit the situation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Explorabilidade

Exploit

Impactos

Pesquisadores

Boramao

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-326: Inadequate Encryption Strength

Identificadores relacionados

CVE-2016-7798