[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <1444165809.2991126.403145441.2CAE05C4@webmail.messagingengine.com>
Date: Tue, 06 Oct 2015 14:10:09 -0700
From: robert@...ert.io
To: oss-security@...ts.openwall.com
Subject: CVE request for sqlalchemy-utils
Description: I noticed that the sqlalchemy-utils package's EncryptedType
does not use a random IV when encrypting with AES in CBC mode. It
generates a SHA256 hash of the user's key and uses the first 16 bytes of
that hash as the IV (and the full hash as the encryption key). The
result is that for a given key, the IV will always be the same.
Reported here: https://github.com/kvesteri/sqlalchemy-utils/issues/166
Version: Current. I'm not sure what the version history of this package
looks like, though.
Reporter: Robert Picard
Please assign a CVE if you feel it would be appropriate for this bug.
- Robert
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
