CVE-2017-5999 Weak cryptography in n/a
sysPass uses non-standard Rijndael-256 instead of AES, potentially allowing attackers to compromise encrypted data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-5999?
CVE-2017-5999 is a high-severity vulnerability in n/a, published on 6 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPT_RIJNDAEL_256() function (the 256-bit block version of Rijndael, not AES) instead of MCRYPT_RIJNDAEL_128 (real AES) could help an attacker to create unknown havoc in the remote system.
Weakness: CWE-326
Which versions are affected by CVE-2017-5999?
It affects 1 product.
Products include Syspass Syspass.
How do I fix CVE-2017-5999?
No fix has been published for CVE-2017-5999 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-5999 being exploited?
There is no known exploitation of CVE-2017-5999 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v4m6-phwc-pmmj.