PT-2017-16819 · Syspass · Syspass

Nuxsmin · Published 2017-03-06 · Updated 2017-03-15 · CVE-2017-5999

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions sysPass versions 2.0 through 2.1

Description An issue was discovered in sysPass where an algorithm was never sufficiently reviewed by cryptographers. The use of the MCRYPT RIJNDAEL 256() function, which is the 256-bit block version of Rijndael and not AES, could potentially help an attacker create havoc in the remote system.

Recommendations For sysPass versions 2.0 through 2.1, update to version 2.1 or later to resolve the issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2017-5999

Affected Products

Syspass

References · 6

• https://github.com/nuxsmin/sysPass/commit/a0e2c485e53b370a7cc6d833e192c3c5bfd70e1f · Patch
• https://github.com/nuxsmin/sysPass/releases/tag/2.1.0.17022601 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-5999 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5999 · Vendor Advisory
• http://securityfocus.com/bid/96562 · Note
• https://cxsecurity.com/issue/WLB-2017020196 · Note