CVE-2016-7420: Infoleak
Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintended in production use, which might allow context-dependent attackers to obtain sensitive information by leveraging access to process memory after an assertion failure, as demonstrated by reading a core dump.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7420?
CVE-2016-7420 has a Medium severity due to the potential information leakage arising from the lack of documentation on compile-time definitions.
How do I fix CVE-2016-7420?
To fix CVE-2016-7420, ensure that the NDEBUG definition is set at compile time to disable assertions in production builds.
What versions of Crypto++ are affected by CVE-2016-7420?
Crypto++ versions up to and including 5.6.4 are affected by CVE-2016-7420.
What type of vulnerabilities does CVE-2016-7420 represent?
CVE-2016-7420 represents a type of information disclosure vulnerability caused by unintended assertions during runtime.
Who can exploit CVE-2016-7420?
Context-dependent attackers with access to process memory can exploit CVE-2016-7420 to obtain sensitive information.