CVE-2012-2146: High severity elixir vulnerability

Elixir prior to and including 0.7.1 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database. A patch has been attached to the initial advisory to mitigate this vulnerability.

— GitHub

It was reported that python-elixir, a library for ORM mapping on top of SQLAlchemy with support for encrypting data stored in a database, suffers from weak use of cryptography. It uses Blowfish in CFB mode, which has an additional parameter (IV), which is not specified and thus defaults to zero. CFB mode is only secure if the the IV is unpredictable and different for every message. Because of this, and because the encryption key is shared for each database table (fields and rows), the same plaintext prefix is always encrypted to an identical and corresponding ciphertext prefix. As a result, an attacker with access to the database could figure out the plaintext values of encrypted text.

— Red Hat