oss-sec mailing list archives
weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request)
From: Vincent Danen <vdanen () redhat com>
Date: Fri, 27 Apr 2012 14:40:48 -0600
Could a CVE be assigned for the following issue? It was reported that python-elixir, a library for ORM mapping on top of SQLAlchemy with support for encrypting data stored in a database, suffers from weak use of cryptography. It uses Blowfish in CFB mode, which has an additional parameter (IV), which is not specified and thus defaults to zero. CFB mode is only secure if the the IV is unpredictable and different for every message. Because of this, and because the encryption key is shared for each database table (fields and rows), the same plaintext prefix is always encrypted to an identical and corresponding ciphertext prefix. As a result, an attacker with access to the database could figure out the plaintext values of encrypted text. References: https://bugzilla.redhat.com/show_bug.cgi?id=810013 http://groups.google.com/group/sqlelixir/browse_thread/thread/efc16227514cffa?pli=1 http://elixir.ematia.de/trac/ticket/119 So far there has been no response from upstream, and we have what I think is a suitable proposal to fix the flaw and a possible migration script to ease migrating from an insecure encrypted db to a secure one (noted in the google groups message). Not sure if anyone else is shipping python-elixir at all, but if you are, input on the proposed fix and migration script (in the absence of an upstream response) would be fantastic. --Vincent Danen / Red Hat Security Response Team
Current thread:
- weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Vincent Danen (Apr 27)
- Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Florian Weimer (Apr 28)
- Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Vincent Danen (Apr 30)
- Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Florian Weimer (May 01)
- Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Florian Weimer (May 01)
- Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Vincent Danen (May 02)
- Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Vincent Danen (Apr 30)
- Re: weak use of crypto in python-elixir can lead to information disclosure (CVE and peer review request) Florian Weimer (Apr 28)