PT-2017-16819 · Syspass · Syspass

Nuxsmin · Publicado 2017-03-06 · Atualizado 2017-03-15 · CVE-2017-5999

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions sysPass versions 2.0 through 2.1

Description An issue was discovered in sysPass where an algorithm was never sufficiently reviewed by cryptographers. The use of the MCRYPT RIJNDAEL 256() function, which is the 256-bit block version of Rijndael and not AES, could potentially help an attacker create havoc in the remote system.

Recommendations For sysPass versions 2.0 through 2.1, update to version 2.1 or later to resolve the issue.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2017-5999

Produtos afetados

Syspass

Referências · 6

• https://github.com/nuxsmin/sysPass/commit/a0e2c485e53b370a7cc6d833e192c3c5bfd70e1f · Correção
• https://github.com/nuxsmin/sysPass/releases/tag/2.1.0.17022601 · Correção
• http://securityfocus.com/bid/96562 · Nota
• https://cxsecurity.com/issue/WLB-2017020196 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5999 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5999 · Aviso do Fabricante