Weak Initialization Vector in Seafile Android Client Compromises Data Security
CVE-2019-8919

7.5HIGH

Key Information:

Vendor

Seafile

Status
Seadroid
Vendor
CVE Published:
18 February 2019

What is CVE-2019-8919?

The Seafile Android Client, specifically version 2.2.13, utilizes the same Initialization Vector (IV) across all encryption operations with Cipher Block Chaining (CBC) mode. This implementation flaw makes the application susceptible to chosen-plaintext attacks and dictionary attacks, as attackers can potentially exploit the predictable IV usage to gain access to protected data.

References

https://github.com/haiwen/seadroid/issues/789
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.