Encryption Bypass in SimpleSAMLphp by Utilizing Initialization Vector
CVE-2017-12871

5.9MEDIUM

Key Information:

Vendor

SimplesamlPHP

Status
SimplesamlPHP
Vendor
CVE Published:
1 September 2017

What is CVE-2017-12871?

The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php within SimpleSAMLphp versions 1.14.x to 1.14.11 can be exploited by attackers to circumvent encryption protections. This occurs through the use of the first 16 bytes of the secret key as the initialization vector (IV), creating a significant risk for applications relying on this library for secure data handling.

References

https://simplesamlphp.org/security/201703-02
x_refsource_CONFIRM
https://github.com/simplesamlphp/simplesamlphp/commit/77d...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.