The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 ruby-attr-encrypted

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2"}]}]

Debian:13 ruby-attr-encrypted

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2"}]}]

Debian:14 ruby-attr-encrypted

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2"}]}]

Debian:12 ruby-encryptor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]

Debian:13 ruby-encryptor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]

Debian:14 ruby-encryptor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]

参照URL

advisory security-tracker.debian.org