PT-2023-29866 · Cryptoes · Cryptoes

Zemnmez · Published 2023-10-24 · Updated 2023-11-08 · CVE-2023-46133

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CryptoES versions prior to 2.1.0

Description The CryptoES PBKDF2 is weaker than originally specified and current industry standards due to defaulting to SHA1 and a single iteration. This weakness can lead to high-impact issues if used for password protection or signature generation. The estimated number of potentially affected devices is high, with at least 10,642 public users and a likely higher number of transient dependents.

Recommendations For versions prior to 2.1.0, configure CryptoES to use SHA256 with at least 250,000 iterations as a workaround. For versions prior to 2.1.0, update to version 2.1.0 to resolve the issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-916

CWE-328

CWE-327

Related Identifiers

CVE-2023-46133

GHSA-MPJ8-Q39X-WQ5H

Affected Products

Cryptoes

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46133.json · Exploit
• 🔥 https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h · Exploit
• https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46133 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46133 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mpj8-q39x-wq5h · Vendor Advisory
• https://github.com/entronad/crypto-es · Note
• https://twitter.com/zemnmez/status/1716905058397454747 · Twitter Post
• https://t.me/latest_high_impact_cve/50 · Telegram Post