PT-2017-12741 · Simplesamlphp · Simplesamlphp

Chris Czub · Publicado 2017-09-01 · Atualizado 2022-05-17 · CVE-2017-12871

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions 1.14.x through 1.14.11

Description The issue makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging the use of the first 16 bytes of the secret key as the initialization vector (IV) in the aesEncrypt method.

Recommendations For SimpleSAMLphp versions 1.14.x through 1.14.11, consider modifying the aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php to use a secure initialization vector (IV) instead of the first 16 bytes of the secret key. As a temporary workaround, restrict access to the aesEncrypt method until a patch is available.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2017-12871

GHSA-WW3W-592J-5QRW

Produtos afetados

Simplesamlphp

Referências · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12871.yaml · Exploit
• https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904 · Correção
• https://github.com/simplesamlphp/simplesamlphp · Nota
• https://github.com/simplesamlphp/simplesamlphp/commit/ccf75981187aa88f7165abdb1b1965c0934acda0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12871 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-12871 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12871 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12871 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12871 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12871 · Aviso do Fabricante
• https://simplesamlphp.org/security/201703-02 · Correção
• https://cve.org/CVERecord?id=CVE-2017-12871 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ww3w-592j-5qrw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-12871 · Aviso do Fabricante