p PatchFirst

GHSA-r2r8-36pq-27cm

GHSA-r2r8-36pq-27cm · nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. Additionally, the reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.

Corrección disponible

Publicación
Actualización

Pila tecnológica: php

Productos y versiones afectados

  • nzo/url-encryptor-bundle Packagist

    Versiones
    • v5.0.0
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 5.0.0, < 5.0.1

    Actualiza a 5.0.1

  • nzo/url-encryptor-bundle Packagist

    Versiones
    • 4.1.0
    • 4.2.0
    • 4.2.1
    • v4.2.2
    • v4.2.3
    • v4.3.0
    • v4.3.1
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 4.0.0, < 4.3.2

    Actualiza a 4.3.2

Fuentes originales

Comprueba tu servidor →