CVE-2013-7463

Опубликовано: 19 апр. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.

Ссылки

http://www.securityfocus.com/bid/98035
https://github.com/Gurpartap/aescrypt/issues/4
Third Party Advisory
http://www.securityfocus.com/bid/98035
https://github.com/Gurpartap/aescrypt/issues/4
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:aescrypt_project:aescrypt:*:*:*:*:*:ruby:*:*

Версия до 1.0.0 (включая)

EPSS

Процентиль: 53%

0.003

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-330

Связанные уязвимости

GHSA-4c4w-3q45-hp9j