Design/Logic Flaw

2017-04-1917:59:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.2%

JSON

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.

CPENameOperatorVersion
aescryptle1.0.0

CPE	Name	Operator	Version
	aescrypt	le	1.0.0

References

www.securityfocus.com/bid/98035

github.com/Gurpartap/aescrypt/issues/4