CVE-2021-41278

🗓️ 18 Nov 2021 23:50:11Reported by GitHub_MType

Functions SDK for EdgeX provides broken "AES" encryption transform, allowing attackers to decrypt messages in versions prior to Jakarta release. Upgrade to v2.1.0 or later for improved "aes256" transform

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-41278	19 Nov 202102:16	–	circl
CNNVD	EdgeX Foundry 加密问题漏洞	19 Nov 202100:00	–	cnnvd
Cvelist	CVE-2021-41278 Broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectors	18 Nov 202123:50	–	cvelist
EUVD	EUVD-2021-2305	7 Oct 202500:30	–	euvd
Github Security Blog	Broken encryption in EdgeX Foundry	19 Nov 202120:55	–	github
NVD	CVE-2021-41278	19 Nov 202100:15	–	nvd
OSV	GHSA-6C7M-QWXJ-MVHP Broken encryption in EdgeX Foundry	19 Nov 202120:55	–	osv
Prion	Input validation	19 Nov 202100:15	–	prion
RedhatCVE	CVE-2021-41278	9 Jan 202609:21	–	redhatcve
Veracode	Weak Encryption	22 Nov 202112:12	–	veracode

NVD

Vulners

Node

edgexfoundry app_service_configurableRange<2.1.0go

edgexfoundry application_functions_software_development_kitRange<2.1.0go

edgexfoundry edgex_foundryRange<2.1.0

[
  {
    "product": "app-functions-sdk-go",
    "vendor": "edgexfoundry",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.1.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/edgexfoundry/app-functions-sdk-go/commit/8fa13c6388ce76a6b878b54490eac61aa7d81165
github	www.github.com/edgexfoundry/app-functions-sdk-go/security/advisories/GHSA-6c7m-qwxj-mvhp

21 Nov 2024 06:25Current

5.3Medium risk

Vulners AI Score5.3

CVSS 22.6

CVSS 3.15.7

CVSS 35.4

EPSS0.00057

CWE-327