CVE-2017-12871: Weak Encryption
Incorrect IV generation for encryption
Other sources
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).
— GitHub
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What versions are affected by CVE-2017-12871?
CVE-2017-12871 affects SimpleSAMLphp versions from 1.14.0 to 1.14.11.
What is the impact of CVE-2017-12871?
CVE-2017-12871 allows context-dependent attackers to bypass encryption protection due to incorrect IV generation.
How do I fix CVE-2017-12871?
To fix CVE-2017-12871, upgrade SimpleSAMLphp to version 1.14.12 or later.
What is the severity rating of CVE-2017-12871?
The severity rating of CVE-2017-12871 is considered to be high due to its potential to allow unauthorized access.
Is CVE-2017-12871 a zero-day vulnerability?
No, CVE-2017-12871 is not a zero-day vulnerability as it was publicly disclosed and a patch is available.