{"id":"CVE-2013-7469","aliases":["DEBIAN-CVE-2013-7469","EUVD-2013-7227","GHSA-fx39-m2fm-46w5","UBUNTU-CVE-2013-7469"],"status":"published","title":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining...","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01089,"percentile":0.6557,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-326"],"published":"2019-02-21T03:00:00Z","modified":"2026-10-17T12:52:49Z","fixes":[{"ecosystem":"Debian:12","package":"seafile","fixed_in":["7.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"seafile","fixed_in":["7.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"seafile","fixed_in":["7.0.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.7-1build1","6.1.1-1","6.1.3-1","6.1.4-1","6.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.11-1","6.2.11-1build1","7.0.2-1","7.0.4-2","7.0.4-4","7.0.5-1","7.0.5-2","7.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.10-1","8.0.4-1","8.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.3-1","9.0.4-1","9.0.4-1.1build2","9.0.4-1.1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.12-2","9.0.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.16-1","9.0.18-2","9.0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"seafile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.13-1","9.0.15-1","9.0.16-1"]}],"products":[{"vendor":"seafile","product":"seafile"}],"references":[{"url":"https://github.com/haiwen/seafile/issues/350","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://drive.google.com/file/d/1rwYsnuhZZxmSR6Zs8rJlWW3R27XBOSJU/view","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7469"},{"url":"https://github.com/advisories/GHSA-fx39-m2fm-46w5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-7469","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-7469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7469","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-7469","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","status":"published","published":"2019-02-21T03:00:00Z","modified":"2024-08-06T18:09:16.891Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2013-7227","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","status":"published","published":"2019-02-21T03:00:00Z","modified":"2024-08-06T18:09:16Z","updated_at":"2026-11-03T01:56:23.526026Z"}],"ghsa":[{"id":"GHSA-fx39-m2fm-46w5","title":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining...","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","status":"published","published":"2022-05-14T01:33:05Z","modified":"2023-02-02T05:04:02Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:51:46.364743Z"}],"nvd":[{"id":"CVE-2013-7469","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","status":"published","published":"2019-02-21T03:29:00.243Z","modified":"2026-06-17T00:02:01.333Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:02:52.545039Z"}],"osv":[{"id":"CVE-2013-7469","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","status":"published","published":"2019-02-21T03:29:00Z","modified":"2026-04-10T03:43:30.172596Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-7469","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","status":"published","published":"2019-02-21T03:29:00.243Z","modified":"2026-09-01T20:03:19.601681234Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"UBUNTU-CVE-2013-7469","description":"Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.","status":"published","published":"2019-02-21T03:29:00Z","modified":"2026-10-17T12:52:49.338935873Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:07.855521Z"}]}}