What versions are affected by CVE-2017-12871?

CVE-2017-12871 affects SimpleSAMLphp versions from 1.14.0 to 1.14.11.

What is the impact of CVE-2017-12871?

CVE-2017-12871 allows context-dependent attackers to bypass encryption protection due to incorrect IV generation.

How do I fix CVE-2017-12871?

To fix CVE-2017-12871, upgrade SimpleSAMLphp to version 1.14.12 or later.

What is the severity rating of CVE-2017-12871?

The severity rating of CVE-2017-12871 is considered to be high due to its potential to allow unauthorized access.

Is CVE-2017-12871 a zero-day vulnerability?

No, CVE-2017-12871 is not a zero-day vulnerability as it was publicly disclosed and a patch is available.

Vulnerability/
CVE-2017-12871

medium

5.9

CWE

326

30/3/2017

1/9/2017

5/8/2024

CVE-2017-12871: Weak Encryption

First published: Thu Mar 30 2017(Updated: )

Incorrect IV generation for encryption

Credit: cve@mitre.org cve@mitre.org

Affected Software	Affected Version	How to fix
composer/simplesamlphp/simplesamlphp	>=1.14.0<1.14.12
composer/simplesamlphp/simplesamlphp	>=1.14.0<1.14.12	1.14.12
SimpleSAMLphp	=1.14.0
SimpleSAMLphp	=1.14.1
SimpleSAMLphp	=1.14.2
SimpleSAMLphp	=1.14.3
SimpleSAMLphp	=1.14.4
SimpleSAMLphp	=1.14.5
SimpleSAMLphp	=1.14.6
SimpleSAMLphp	=1.14.7
SimpleSAMLphp	=1.14.8
SimpleSAMLphp	=1.14.9
SimpleSAMLphp	=1.14.10
SimpleSAMLphp	=1.14.11

Remedy

https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904

Remedy

https://simplesamlphp.org/security/201703-02

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What versions are affected by CVE-2017-12871?
CVE-2017-12871 affects SimpleSAMLphp versions from 1.14.0 to 1.14.11.
What is the impact of CVE-2017-12871?
CVE-2017-12871 allows context-dependent attackers to bypass encryption protection due to incorrect IV generation.
How do I fix CVE-2017-12871?
To fix CVE-2017-12871, upgrade SimpleSAMLphp to version 1.14.12 or later.
What is the severity rating of CVE-2017-12871?
The severity rating of CVE-2017-12871 is considered to be high due to its potential to allow unauthorized access.
Is CVE-2017-12871 a zero-day vulnerability?
No, CVE-2017-12871 is not a zero-day vulnerability as it was publicly disclosed and a patch is available.

collector/friends-of-php
agent/type
agent/first-publish-date
agent/remedy
collector/github-advisory-latest
source/GitHub
alias/GHSA-ww3w-592j-5qrw
alias/CVE-2017-12871
agent/software-canonical-lookup
agent/references
agent/severity
agent/softwarecombine
agent/weakness
agent/description
agent/author
collector/github-advisory
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/event
agent/trending
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
collector/nvd-cve
source/NVD
package-manager/composer
vendor/simplesamlphp
canonical/simplesamlphp
version/simplesamlphp/1.14.0
version/simplesamlphp/1.14.1
version/simplesamlphp/1.14.2
version/simplesamlphp/1.14.3
version/simplesamlphp/1.14.4
version/simplesamlphp/1.14.5
version/simplesamlphp/1.14.6
version/simplesamlphp/1.14.7
version/simplesamlphp/1.14.8
version/simplesamlphp/1.14.9
version/simplesamlphp/1.14.10
version/simplesamlphp/1.14.11

Frequently Asked Questions

What versions are affected by CVE-2017-12871?
CVE-2017-12871 affects SimpleSAMLphp versions from 1.14.0 to 1.14.11.
What is the impact of CVE-2017-12871?
CVE-2017-12871 allows context-dependent attackers to bypass encryption protection due to incorrect IV generation.
How do I fix CVE-2017-12871?
To fix CVE-2017-12871, upgrade SimpleSAMLphp to version 1.14.12 or later.
What is the severity rating of CVE-2017-12871?
The severity rating of CVE-2017-12871 is considered to be high due to its potential to allow unauthorized access.
Is CVE-2017-12871 a zero-day vulnerability?
No, CVE-2017-12871 is not a zero-day vulnerability as it was publicly disclosed and a patch is available.

CVE-2017-12871: Weak Encryption

Remedy

Remedy

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What versions are affected by CVE-2017-12871?

What is the impact of CVE-2017-12871?

How do I fix CVE-2017-12871?

What is the severity rating of CVE-2017-12871?

Is CVE-2017-12871 a zero-day vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What versions are affected by CVE-2017-12871?

What is the impact of CVE-2017-12871?

How do I fix CVE-2017-12871?

What is the severity rating of CVE-2017-12871?

Is CVE-2017-12871 a zero-day vulnerability?