CVE-2012-3458 Beaker Sensitive Information Disclosure vulnerability
Remote attackers can obtain sensitive session data due to weak AES-ECB encryption in Beaker when PyCrypto is used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-3458?
CVE-2012-3458 is a medium-severity vulnerability in n/a, published on 15 Sep 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
Weakness: CWE-310
Which versions are affected by CVE-2012-3458?
3 open source packages ship an affected version, including beaker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
beaker PyPI | All versions | 1.6.4 |
beaker PyPI | All versions | 1.6.4 |
beaker PyPI | All versions | 1.6.5.post1 |
Linux distribution packages (2)
python-Beaker openSUSE:Tumbleweed | All versions | 1.11.0-5.5 |
python-Beaker openSUSE:Tumbleweed | All versions | 1.13.0-2.4 |
Products include Python Beaker.
How do I fix CVE-2012-3458?
Upgrade beaker to a fixed version for your release line: 1.6.4 or 1.6.5.post1.
Is CVE-2012-3458 being exploited?
There is no known exploitation of CVE-2012-3458 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2012-3458, DSA-2541-1, GHSA-39vm-p9mr-4r27, PYSEC-2012-1, openSUSE-SU-2024:10317-1, openSUSE-SU-2024:11203-1 and 2 more.