CVE-2016-7798 — Inadequate Encryption Strength in Openssl
Severity
7.5HIGHNVD
EPSS
0.8%
top 26.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 30
Latest updateOct 24
Description
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages2 packages
Also affects: Debian Linux 8.0, 9.0
Patches
🔴Vulnerability Details
4CVEList▶
CVE-2016-7798: The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for↗2017-01-30
OSV▶
CVE-2016-7798: The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for↗2017-01-30
📋Vendor Advisories
4Microsoft▶
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key which makes it easier for context-dependent attackers to bypass the encrypti↗2017-01-10
Debian▶
CVE-2016-7798: ruby-attr-encrypted - The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (a...↗2016