PT-2017-9351

CVE-2016-7798

Published

2016-10-13

Updated

2020-11-05

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openssl gem for Ruby (affected versions not specified)

Description The issue arises when the initialization vector (IV) is set before the key in GCM Mode (aes-*-gcm), allowing context-dependent attackers to bypass the encryption protection mechanism. This makes it easier for attackers to exploit the situation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Boramao

Vendors

Affected products

Weakness enumeration

CWE-326: Inadequate Encryption Strength

Related identifiers

CVE-2016-7798