CVE-2020-10256 Weak cryptography in n/a
Insecure random number generation in 1Password CLI and SCIM bridge allows attackers to brute-force encryption keys and decrypt user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10256?
CVE-2020-10256 is a critical vulnerability in n/a, published on 27 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to perform brute-force calculations of encryption keys and thus succeed at decryption.
Which versions are affected by CVE-2020-10256?
It affects 2 products.
Products include 1password Command Line Interface, 1password Scim.
How do I fix CVE-2020-10256?
No fix has been published for CVE-2020-10256 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10256 being exploited?
There is no known exploitation of CVE-2020-10256 in the wild and no public exploit code.
Sources
Also known as GHSA-6fcj-rv73-f37c.