Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jaGc5LTNjM3AtY2gyM84AAQ0c

Lemur uses static IV per key

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.

Permalink: https://github.com/advisories/GHSA-chg9-3c3p-ch23
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jaGc5LTNjM3AtY2gyM84AAQ0c
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 2 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-chg9-3c3p-ch23, CVE-2015-7764
References:

• https://nvd.nist.gov/vuln/detail/CVE-2015-7764
• https://github.com/Netflix/lemur/issues/117
• https://github.com/kvesteri/sqlalchemy-utils/issues/166
• http://www.openwall.com/lists/oss-security/2015/10/20/3
• https://github.com/Netflix/lemur/commit/394e18f76e5eb534d95160945ebc231ec3b4c794
• https://github.com/pypa/advisory-database/tree/main/vulns/lemur/PYSEC-2017-50.yaml
• https://github.com/advisories/GHSA-chg9-3c3p-ch23

Repository: https://github.com/Netflix/lemur
Blast Radius: 10.6

Affected Packages