CVE-2012-3458: Weak Encryption
First published: Mon Apr 02 2012(Updated: )
Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/beaker | <1.6.4 | 1.6.4 |
| Red Hat Python-beaker | <=1.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/50226
- http://secunia.com/advisories/50520
- http://www.debian.org/security/2012/dsa-2541
- http://www.openwall.com/lists/oss-security/2012/08/13/10
- https://bugzilla.redhat.com/show_bug.cgi?id=809267
- https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5
- https://github.com/bbangert/beaker/commit/4733630c0359636f5ab8e1b2b33470c67b5ba4fc
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847898
- https://nvd.nist.gov/vuln/detail/CVE-2012-3458
- https://web.archive.org/web/20140724164516/http://secunia.com/advisories/50226
- https://web.archive.org/web/20140725025612/http://secunia.com/advisories/50520
- https://github.com/advisories/GHSA-39vm-p9mr-4r27 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/beaker/PYSEC-2012-1.yaml
Frequently Asked Questions
What is the severity of CVE-2012-3458?
CVE-2012-3458 has a moderate severity rating due to the vulnerabilities in session data encryption.
How do I fix CVE-2012-3458?
To fix CVE-2012-3458, upgrade to Beaker version 1.6.4 or later to avoid the weak AES ECB mode.
What specifically is vulnerable in CVE-2012-3458?
CVE-2012-3458 is vulnerable due to the use of AES in ECB mode for session encryption, which can expose sensitive data.
Which versions of Beaker are affected by CVE-2012-3458?
Beaker versions prior to 1.6.4 are affected by CVE-2012-3458.
Can attackers exploit CVE-2012-3458 remotely?
Yes, attackers can exploit CVE-2012-3458 remotely to obtain portions of sensitive session data.
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-3458
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-39vm-p9mr-4r27
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- collector/github-advisory
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/pip
- vendor/python
- canonical/red hat python-beaker
- version/red hat python-beaker/1.6.4