CVE-2020-7069

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with opensslencrypt function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data...

CVE-2020-7069

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with opensslencrypt function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data...

Insecure Encryption

php7 is using an insecure encryption. The vulnerability exists when AES-CCM mode is used with opensslencrypt function with 12 bytes IV, only first 7 bytes of the IV. This can lead to both decreased security and incorrect encryption data...

[SECURITY] Fedora 33 Update: mysql-connector-java-8.0.21-1.fc33

MySQL Connector/J is a native Java driver that converts JDBC Java Database Connectivity calls into the network protocol used by the MySQL database. It lets developers working with the Java programming language easily build programs and applets that interact with MySQL and connect all corporate...

CVE-2020-0407

In various functions in fscryptice.c and related files in some implementations of f2fs encryption that use encryption hardware which only supports 32-bit IVs Initialization Vectors, 64-bit IVs are used and later are truncated to 32 bits. This may cause IV reuse and thus weakened disk encryption...

Design/Logic Flaw

In various functions in fscryptice.c and related files in some implementations of f2fs encryption that use encryption hardware which only supports 32-bit IVs Initialization Vectors, 64-bit IVs are used and later are truncated to 32 bits. This may cause IV reuse and thus weakened disk encryption...

CVE-2020-0407

The CVE-2020-0407 entry concerns Android kernel/F2FS encryption where hardware that supports only 32-bit IVs leads to truncation to 32 bits for 64-bit IVs in certain implementations. This IV truncation can cause IV reuse, weakening disk encryption and potentially enabling local information disclo...

CVE-2020-0407

In various functions in fscryptice.c and related files in some implementations of f2fs encryption that use encryption hardware which only supports 32-bit IVs Initialization Vectors, 64-bit IVs are used and later are truncated to 32 bits. This may cause IV reuse and thus weakened disk encryption...

GHSA-Q643-W9JP-Q2QG Hardcoded Initialization Vector in parsel

All versions of parsel have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks. Recommendation The package is deprecated and will not be updated. Consider using an...

SUSE SLES12 Security Update : ruby2.1 (SUSE-SU-2020:1570-1)

This update for ruby2.1 fixes the following issues : Security issues fixed : CVE-2015-9096: Fixed an SMTP command injection via CRLFsequences in a RCPT TO or MAIL FROM command bsc1043983. CVE-2016-7798: Fixed an IV Reuse in GCM Mode bsc1055265. CVE-2017-0898: Fixed a buffer underrun vulnerability...

Insecure default secret key and IV allowing anyone to decrypt values

This issue has been deleted...

Insecure default secret key and IV allowing anyone to decrypt values

This issue has been deleted...

PT-2020-5865 · Php +9 · Php +9

Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x below 7.2.34 PHP versions 7.3.x below 7.3.23 PHP versions 7.4.x below 7.4.11 Description: The issue is related to the openssl encrypt function in PHP when used with AES-CCM mode and a 12-byte initialization vector IV. Only...

Zoom Client Encryption Issue Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. An encryption issue vulnerability exists in Zoom Client for Meetings version 4.6.11, which stems from the airhost.exe file using 3423423432325249 as the initialization vector IV for AES-256 CBC...

Nextcloud: Reduced purmations on encryption

OC\Security\SecureRandom::generate Reduced Permutations OC\Security\SecureRandom::generate will by default use a-Z0-9+/ 64 bytes character set. The numbers are not predictable, due to the use of randomint. Most notably the OC\Security\Crypto::encrypt method uses an IV with a length of 16 bytes. I...

Code injection

airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector IV for AES-256 CBC encryption. NOTE: the vendor states that this IV is used only within unreachable code...

CVE-2020-11877

CVE-2020-11877 concerns Zoom Client for Meetings 4.6.11, where the component airhost.exe uses a static IV (3423423432325249) for AES-256 CBC. The Red Hat entry repeats the description and notes the IV is used in unreachable code, meaning exploitation depends on the code path becoming reachable. P...

CVE-2020-11877

airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector IV for AES-256 CBC encryption. NOTE: the vendor states that this IV is used only within unreachable code...

PT-2020-12911 · Zoom · Zoom Client For Meetings

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings version 4.6.11 Description: The issue concerns the use of a static Initialization Vector IV for AES-256 CBC encryption in the airhost.exe component. Specifically, the IV used is 3423423432325249. The vendor notes that...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2020-1432)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...