PT-2022-4970 · Aes Crypt · Aescrypt

Published 2022-07-15 · Updated 2023-06-29 · CVE-2022-35928

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AES Crypt version 3.11

Description The issue is related to reading user-provided passwords and confirmations via command-line prompts in AES Crypt for Linux. Password lengths were not checked before being read, which may lead to buffer overruns. This vulnerability does not affect source code found on aescrypt.com, nor is it present when providing a password or a key via the -p or -k command-line options.

Recommendations For AES Crypt version 3.11, users are advised to upgrade to release 3.16 to fix the issue. Users unable to upgrade should use the -p or -k options to provide a password or key.

Exploit

Fix

Improper Authentication

Buffer Overflow

Weakness Enumeration

CWE-287

CWE-1284

CWE-120

Related Identifiers

BDU:2022-06164

CVE-2022-35928

GHSA-R7FV-72PG-FWRQ

Affected Products

Aescrypt

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35928.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35928 · Security Note
• https://github.com/paulej/AESCrypt/commit/68761851b595e96c68c3f46bfc21167e72c6a22c · Patch
• https://github.com/paulej/AESCrypt/security/advisories/GHSA-r7fv-72pg-fwrq · Patch
• https://osv.dev/vulnerability/CVE-2022-35928 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06164 · Security Note
• https://t.me/cvenotify/53320 · Telegram Post
• https://t.me/cibsecurity/47519 · Telegram Post
• https://t.me/cvenotify/34236 · Telegram Post