CVE-2013-7463

Published: Apr 19, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.

Affected (1)

Products: Aescrypt Project: Aescrypt

Aescrypt Project

1 product

Aescrypt

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Aescrypt Project Aescrypt	Up to 1.0.0

Related CWEs

CWE-330

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (4)

http://www.securityfocus.com/bid/98035

Source: cve@mitre.org

https://github.com/Gurpartap/aescrypt/issues/4

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/98035

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/Gurpartap/aescrypt/issues/4

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.