CVE-2017-5999: Weak Encryption
An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPTRIJNDAEL256() function (the 256-bit block version of Rijndael, not AES) instead of MCRYPTRIJNDAEL128 (real AES) could help an attacker to create unknown havoc in the remote system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5999?
CVE-2017-5999 is considered a high severity vulnerability due to the use of insecure cryptographic practices.
How do I fix CVE-2017-5999?
To fix CVE-2017-5999, upgrade sysPass to version 2.1 or later, which addresses the cryptographic issues.
What impact does CVE-2017-5999 have on sysPass 2.0?
CVE-2017-5999 may allow attackers to exploit weak encryption methods used in sysPass 2.0, compromising sensitive data.
What is the affected software for CVE-2017-5999?
The affected software for CVE-2017-5999 is sysPass version 2.0.
Is CVE-2017-5999 related to AES encryption?
Yes, CVE-2017-5999 is related to the improper use of Rijndael instead of the AES encryption standard.