CWE-329 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-329/ Sun, 26 Feb 2023 09:06:46 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-329 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-329/ 32 32 CVE-2007-3528 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-3528/ Sun, 26 Feb 2023 09:06:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-3528/ The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by (1) discarding random bits by the blowfish::make_ivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and (2) direct use of a password for keying, which makes it easier for context-dependent attackers to decrypt files.

The post CVE-2007-3528 appeared first on CVE Vulnerability.

]]> The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by (1) discarding random bits by the blowfish::make_ivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and (2) direct use of a password for keying, which makes it easier for context-dependent attackers to decrypt files.

The post CVE-2007-3528 appeared first on CVE Vulnerability.

]]> CVE-2020-5408 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5408/ Sun, 26 Feb 2023 06:42:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5408/ Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such […]

The post CVE-2020-5408 appeared first on CVE Vulnerability.

]]> Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

The post CVE-2020-5408 appeared first on CVE Vulnerability.

]]>