PT-2012-4731 · Pycrypto+1 · Pycrypto+1

Vincent Danen · Publicado 2012-09-15 · Atualizado 2024-06-15 · CVE-2012-3458

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Beaker versions prior to 1.6.4

Description The issue allows remote attackers to potentially obtain portions of sensitive session data. This is due to the use of AES in ECB cipher mode when PyCrypto is used to encrypt sessions.

Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-310

Identificadores relacionados

CVE-2012-3458

DSA-2541-1

GHSA-39VM-P9MR-4R27

OPENSUSE-SU-2024:10317-1

OPENSUSE-SU-2024:11203-1

OPENSUSE-SU-2024:13886-1

PYSEC-2012-1

Produtos afetados

Beaker

Pycrypto

Referências · 21

• https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5 · Nota
• https://github.com/bbangert/beaker · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/beaker/PYSEC-2012-1.yaml · Nota
• https://cve.org/CVERecord?id=CVE-2012-3458 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-39vm-p9mr-4r27 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11203-1 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2541 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3458 · Aviso do Fabricante
• http://secunia.com/advisories/50520 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/08/13/10 · Nota
• http://secunia.com/advisories/50226 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3458 · Nota de Segurança
• https://suse.com/security/cve/CVE-2012-3458 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3458 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-3458 · Aviso do Fabricante