GHSA-r2r8-36pq-27cm
GHSA-r2r8-36pq-27cm · nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. Additionally, the reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.
Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
nzo/url-encryptor-bundle Packagist
- Softwareversionen
- v5.0.0
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 5.0.0, < 5.0.1
Auf 5.0.1 aktualisieren
nzo/url-encryptor-bundle Packagist
- Softwareversionen
- 4.1.0
- 4.2.0
- 4.2.1
- v4.2.2
- v4.2.3
- v4.3.0
- v4.3.1
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 4.0.0, < 4.3.2
Auf 4.3.2 aktualisieren
Originalquellen
- https://github.com/nayzo/NzoUrlEncryptorBundle/commit/ba3af1a9bcf3bedcc0ed5948979f482e2134da1a
- https://github.com/nayzo/NzoUrlEncryptorBundle/commit/bd8232501c12c9df1bc45b1970870ef665218581
- https://github.com/FriendsOfPHP/security-advisories/blob/master/nzo/url-encryptor-bundle/2020-05-03.yaml
- https://github.com/nayzo/NzoUrlEncryptorBundle
- https://osv.dev/vulnerability/GHSA-r2r8-36pq-27cm