CVE-2015-20112

Published: Jun 29, 2025Modified: Jun 30, 2025

3.4

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: MITRE (Secondary)

Description

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.

Related CWEs

Missing Cryptographic Step

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

References (5)

https://github.com/LaurentMT/go-ethereum/commit/e8cba7283b57280b1bcf5761478f852398365901

Source: cve@mitre.org

https://github.com/ethereum/devp2p/blob/master/rlpx.md#known-issues-in-the-current-version

Source: cve@mitre.org

https://github.com/ethereum/devp2p/issues/32

Source: cve@mitre.org

https://github.com/ethereum/go-ethereum/issues/1315

Source: cve@mitre.org

https://github.com/hyperledger/besu/issues/7926

Source: cve@mitre.org

Timeline

No history available yet.