CVE-2014-3462: Infoleak
First published: Wed May 14 2014(Updated: )
A number of issues were found in the cryptography practices of EncFS. These are detailed in the following audit: <a href="https://defuse.ca/audits/encfs.htm">https://defuse.ca/audits/encfs.htm</a> It also notes some of the issues in <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2010-3073 CVE-2010-3074 CVE-2010-3075 fuse-encfs: EncFS: Multiple flaws" href="show_bug.cgi?id=630460">bug 630460</a> may not be fixed correctly. A fix is currently not available. Fedora and EPEL use a 1.x version. A future 2.0 release may correct these issues: <a href="https://code.google.com/p/encfs/issues/detail?id=186">https://code.google.com/p/encfs/issues/detail?id=186</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| openSUSE | =42.1 | |
| openSUSE | =42.2 | |
| openSUSE | =13.2 | |
| encfs project encfs | <1.7.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://defuse.ca/audits/encfs.htm
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=630460
- https://code.google.com/p/encfs/issues/detail?id=186
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1097539
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1097540
- http://www.openwall.com/lists/oss-security/2014/05/14/1
- https://access.redhat.com/security/cve/CVE-2014-3462
- http://seclists.org/oss-sec/2014/q2/305
- https://bugzilla.redhat.com/show_bug.cgi?id=1097537
- http://lists.opensuse.org/opensuse-updates/2017-01/msg00090.html
- http://www.openwall.com/lists/oss-security/2014/05/14/2
- https://security.gentoo.org/glsa/201512-09
Frequently Asked Questions
What is the severity of CVE-2014-3462?
CVE-2014-3462 is considered to have a critical severity due to significant cryptographic flaws.
How do I fix CVE-2014-3462?
To address CVE-2014-3462, it is recommended to upgrade to EncFS version 1.7.6 or later.
What software is affected by CVE-2014-3462?
CVE-2014-3462 affects versions of EncFS up to 1.7.5 and specific versions of openSUSE such as 13.2, 42.1, and 42.2.
Is CVE-2014-3462 a known vulnerability?
Yes, CVE-2014-3462 is a known vulnerability documented in various security audits and reports.
What are the implications of CVE-2014-3462?
The implications of CVE-2014-3462 include potential unauthorized data access due to weak cryptographic practices.
- agent/type
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-3462
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/opensuse
- canonical/opensuse
- version/opensuse/42.1
- version/opensuse/42.2
- version/opensuse/13.2
- vendor/encfs project
- canonical/encfs project encfs