CVE - CVE-2016-7798

CVE-ID
CVE-2016-7798	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:93031 URL:http://www.securityfocus.com/bid/93031 CONFIRM:https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062 CONFIRM:https://github.com/ruby/openssl/issues/49 DEBIAN:DSA-3966 URL:https://www.debian.org/security/2017/dsa-3966 MLIST:[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update URL:https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html MLIST:[oss-security] 20160919 CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode URL:http://www.openwall.com/lists/oss-security/2016/09/19/9 MLIST:[oss-security] 20160930 Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode URL:http://www.openwall.com/lists/oss-security/2016/09/30/6 MLIST:[oss-security] 20160930 Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode URL:http://www.openwall.com/lists/oss-security/2016/10/01/2
Assigning CNA
MITRE Corporation
Date Record Created
20160909	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20160909)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)