Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2016-7798 →
DEBIAN-CVE-2016-7798
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
ruby-attr-encrypted
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2"}]}]
Debian:13
ruby-attr-encrypted
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2"}]}]
Debian:14
ruby-attr-encrypted
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-2"}]}]
Debian:12
ruby-encryptor
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]
Debian:13
ruby-encryptor
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]
Debian:14
ruby-encryptor
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-1"}]}]
Références
- advisory security-tracker.debian.org