{"id":"CVE-2012-3458","aliases":["DEBIAN-CVE-2012-3458","DSA-2541-1","EUVD-2012-0002","GHSA-39vm-p9mr-4r27","PYSEC-2012-1","UBUNTU-CVE-2012-3458","openSUSE-SU-2024:10317-1","openSUSE-SU-2024:11203-1","openSUSE-SU-2024:13886-1","openSUSE-SU-2026:11987-1"],"status":"published","title":"Beaker Sensitive Information Disclosure vulnerability","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02458,"percentile":0.84539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310","CWE-326"],"published":"2012-09-07T00:00:00Z","modified":"2026-10-23T17:47:35Z","fixes":[{"ecosystem":"PyPI","package":"beaker","fixed_in":["1.6.4","1.6.5.post1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"beaker","fixed_in":["1.6.3-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"beaker","fixed_in":["1.6.3-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"beaker","fixed_in":["1.6.3-1.1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"beaker","fixed_in":["1.5.4-4+squeeze1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Beaker","fixed_in":["1.11.0-5.5","1.13.0-2.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-4+squeeze1"}]}],"versions":["1.5.4-4"]},{"source":"osv","ecosystem":"PyPI","package":"beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4"}]}],"versions":["0.5","0.6","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.8","0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.0.3","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.2.3","1.3","1.3.1","1.3.1dev","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3"]},{"source":"osv","ecosystem":"PyPI","package":"beaker","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"91becae76101cf87ce8cbfabe3af2622fc328fe5"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5.post1"}]}],"versions":["0.5","0.6","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.8","0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.0.3","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.2.3","1.3","1.3.1","1.3.1dev","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","v1.6.2","v.1.6.1","v1.6","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5","v1.4.2","v1.4.1","v1.4","v1.3.1","v1.3","v1.2.2","v1.2.1","v1.2","v1.1.3","v1.1.2","v1.1.1","v1.1","v1.0.3","v1.0.2","v1.0.1","v1.0","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9","v0.8.1","v0.8","v0.7.5","v0.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-5.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Beaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-2.4"}]}]}],"products":[{"vendor":"python","product":"beaker"}],"references":[{"url":"https://github.com/bbangert/beaker/commit/91becae76101cf87ce8cbfabe3af2622fc328fe5","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"http://secunia.com/advisories/50226","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/50520","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2012/08/13/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.debian.org/security/2012/dsa-2541","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=809267","tags":["x_refsource_MISC","x_transferred","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3458","tags":["advisory"]},{"url":"https://web.archive.org/web/20140724164516/http://secunia.com/advisories/50226","tags":["web"]},{"url":"https://web.archive.org/web/20140725025612/http://secunia.com/advisories/50520","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/beaker/PYSEC-2012-1.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-39vm-p9mr-4r27","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-3458","tags":["advisory"]},{"url":"https://github.com/bbangert/beaker","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2012-3458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3458","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3458","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-3458","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2012-09-15T17:00:00Z","modified":"2024-08-06T20:05:12.551Z","updated_at":"2026-11-02T14:34:50.94153Z"}],"euvd":[{"id":"EUVD-2012-0002","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2012-09-15T17:00:00Z","modified":"2024-08-06T20:05:12Z","updated_at":"2026-11-03T01:56:11.327216Z"}],"ghsa":[{"id":"GHSA-39vm-p9mr-4r27","title":"Beaker Sensitive Information Disclosure vulnerability","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2022-05-17T05:22:19Z","modified":"2024-09-12T21:05:42Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:38:02.014847Z"}],"nvd":[{"id":"CVE-2012-3458","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2012-09-15T17:55:07.147Z","modified":"2026-06-16T23:43:15.723Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:15.643902Z"}],"osv":[{"id":"GHSA-39vm-p9mr-4r27","title":"Beaker Sensitive Information Disclosure vulnerability","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2022-05-17T05:22:19Z","modified":"2024-09-12T21:21:18.708083Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"CVE-2012-3458","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2012-09-15T17:55:07Z","modified":"2026-10-05T10:26:48.72667892Z","updated_at":"2026-11-02T15:43:58.537032Z"},{"id":"DEBIAN-CVE-2012-3458","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2012-09-15T17:55:07.147Z","modified":"2026-10-23T17:47:35.378331584Z","updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"DSA-2541-1","title":"beaker - information disclosure","status":"published","published":"2012-09-07T00:00:00Z","modified":"2026-03-09T01:18:58.514492Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"openSUSE-SU-2024:10317-1","title":"python-Beaker-1.8.1-1.1 on GA media","description":"These are all security issues fixed in the python-Beaker-1.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:09.622587Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11203-1","title":"python36-Beaker-1.11.0-5.5 on GA media","description":"These are all security issues fixed in the python36-Beaker-1.11.0-5.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:40.132424Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13886-1","title":"python310-Beaker-1.13.0-1.1 on GA media","description":"These are all security issues fixed in the python310-Beaker-1.13.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:28.774977Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11987-1","title":"python313-Beaker-1.13.0-2.4 on GA media","description":"These are all security issues fixed in the python313-Beaker-1.13.0-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:33.342512518Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2012-1","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"published","published":"2012-09-15T17:55:00Z","modified":"2026-06-10T17:00:38.335141589Z","updated_at":"2026-11-02T15:52:51.254177Z"},{"id":"UBUNTU-CVE-2012-3458","description":"Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.","status":"withdrawn","published":"2012-09-15T17:55:00Z","modified":"2025-07-16T07:30:57.133319Z","updated_at":"2026-11-02T15:54:06.395274Z"}]}}