Описание
Aescrypt does not sufficiently use random values
The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.
Пакеты
Наименование
aescrypt
rubygems
Затронутые версииВерсия исправления
<= 1.0.0
Отсутствует
Связанные уязвимости
CVSS3: 7.5
nvd
почти 9 лет назад
The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.