GHSA-6h88-qjpv-p32m

    Dashboard / Vulnerabilities / GHSA-6h88-qjpv-p32m

    GHSA-6h88-qjpv-p32m

    Published: 24 Oct 2017Last Modified: 16 Feb 2024
    Aliases:
    CVE-2016-7798

    Summary: OpenSSL gem for Ruby using inadequate encryption strength

    Details: The OpenSSL gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.

    References: https://nvd.nist.gov/vuln/detail/CVE-2016-7798, https://github.com/ruby/openssl/issues/49, https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062, https://github.com/advisories/GHSA-6h88-qjpv-p32m, https://github.com/ruby/openssl, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openssl/CVE-2016-7798.yml, https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html, https://web.archive.org/web/20210121065227/https://www.securityfocus.com/bid/93031/info, https://www.debian.org/security/2017/dsa-3966, http://www.openwall.com/lists/oss-security/2016/09/19/9, http://www.openwall.com/lists/oss-security/2016/09/30/6, http://www.openwall.com/lists/oss-security/2016/10/01/2

    Affected packages

    Package

    Name: openssl

    Purl: pkg:gem/openssl

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.0.0

    Affected versions

    2.0.0.beta.1
    2.0.0.beta.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High