PT-2020-12500 · Teclib+1 · Glpi+1

Orthagh · Published 2020-09-23 · Updated 2024-05-22 · CVE-2020-11031

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.5.0

Description The issue is related to an insecure encryption algorithm used in the software. The security of the encrypted data relies on the password used, and if a user sets a weak or predictable password, an attacker could potentially decrypt the data. A more secure encryption library, sodium, is used in the fixed version to address this issue.

Recommendations For versions prior to 9.5.0, update to version 9.5.0 or later, which uses a more secure encryption library to mitigate the risk.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

ALT-PU-2020-3130

ALT-PU-2020-3162

ALT-PU-2024-8094

CVE-2020-11031

GHSA-7XWM-4VJR-JVQH

Affected Products

Alt Linux

Glpi

References · 7

• https://github.com/glpi-project/glpi/commit/f1ae6c8481e5c19a6f1801a5548cada45702e01a#diff-b5d0ee8c97c7abd7e3fa29b9a27d1780 · Patch
• https://osv.dev/vulnerability/CVE-2020-11031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11031 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-11031 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11031 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11031 · Vendor Advisory
• https://github.com/glpi-project/glpi/security/advisories/GHSA-7xwm-4vjr-jvqh · Note