CVE-2012-2146 Elixir can leak information due to weak use of crypto
Elixir library uses static IVs in Blowfish CFB mode, allowing attackers to decrypt database contents and access sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-2146?
CVE-2012-2146 is a medium-severity vulnerability in n/a, published on 26 Aug 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database.
Weakness: CWE-310
Which versions are affected by CVE-2012-2146?
3 open source packages ship an affected version, including elixir and Elixir. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
elixir PyPI | All versions | None |
elixir PyPI | All versions to 0.7.1 | None |
Elixir PyPI | All versions to 0.7.1 | None |
Products include Ematia Elixir.
How do I fix CVE-2012-2146?
Upgrade to a fixed version.
Is CVE-2012-2146 being exploited?
There is no known exploitation of CVE-2012-2146 in the wild and no public exploit code.
Sources
Also known as GHSA-vfcg-5ggc-3rxx, PYSEC-2012-13, UBUNTU-CVE-2012-2146.