PT-2023-29866 · Cryptoes · Cryptoes

Zemnmez · Publicado 2023-10-24 · Atualizado 2023-11-08 · CVE-2023-46133

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CryptoES versions prior to 2.1.0

Description The CryptoES PBKDF2 is weaker than originally specified and current industry standards due to defaulting to SHA1 and a single iteration. This weakness can lead to high-impact issues if used for password protection or signature generation. The estimated number of potentially affected devices is high, with at least 10,642 public users and a likely higher number of transient dependents.

Recommendations For versions prior to 2.1.0, configure CryptoES to use SHA256 with at least 250,000 iterations as a workaround. For versions prior to 2.1.0, update to version 2.1.0 to resolve the issue.

Exploit

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-916

CWE-328

CWE-327

Identificadores relacionados

CVE-2023-46133

GHSA-MPJ8-Q39X-WQ5H

Produtos afetados

Cryptoes

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46133.json · Exploit
• 🔥 https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h · Exploit
• https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757 · Correção
• https://github.com/entronad/crypto-es · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-46133 · Nota de Segurança
• https://twitter.com/zemnmez/status/1716905058397454747 · Publicação no Twitter
• https://t.me/latest_high_impact_cve/50 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-46133 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mpj8-q39x-wq5h · Aviso do Fabricante