CVE-2013-7463 Aescrypt does not sufficiently use random values
HighCVSS 7.5
EPSS 1.1%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems aescrypt(RubyGems) | <= 1.0.0 | No fix listed |
| rubygems aescrypt(RubyGems) | = 1.0.0 | No fix listed |
| aescrypt project aescrypt | <= 1.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com third-party-advisory
- web.archive.org
- github.com exploit
- github.com
- github.com product
- 98035 vdb-entry