{"id":"CVE-2015-7764","aliases":["EUVD-2017-0069","GHSA-chg9-3c3p-ch23","PYSEC-2017-50"],"status":"published","title":"Lemur uses static IV per key","description":"Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01511,"percentile":0.74632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-331"],"published":"2017-08-09T16:00:00Z","modified":"2026-09-10T03:49:22Z","fixes":[{"ecosystem":"PyPI","package":"lemur","fixed_in":["0.1.5","0.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lemur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"lemur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"lemur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]}],"products":[{"vendor":"netflix","product":"lemur"}],"references":[{"url":"https://github.com/Netflix/lemur/issues/117","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/10/20/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://github.com/kvesteri/sqlalchemy-utils/issues/166","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7764","tags":["advisory"]},{"url":"https://github.com/Netflix/lemur/commit/394e18f76e5eb534d95160945ebc231ec3b4c794","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/lemur/PYSEC-2017-50.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-chg9-3c3p-ch23","tags":["advisory"]},{"url":"https://github.com/Netflix/lemur","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-7764","description":"Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.","status":"published","published":"2017-08-09T16:00:00Z","modified":"2024-08-06T07:58:59.963Z","updated_at":"2026-11-02T14:35:45.088047Z"}],"euvd":[{"id":"EUVD-2017-0069","description":"Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.","status":"published","published":"2017-08-09T16:00:00Z","modified":"2024-08-06T07:58:59Z","updated_at":"2026-11-03T02:21:50.987466Z"}],"ghsa":[{"id":"GHSA-chg9-3c3p-ch23","title":"Lemur uses static IV per key","description":"Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.","status":"published","published":"2022-05-13T01:30:21Z","modified":"2024-09-30T16:13:22Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2015-7764","description":"Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.","status":"published","published":"2017-08-09T16:29:00.363Z","modified":"2026-06-17T00:33:05.733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"GHSA-chg9-3c3p-ch23","title":"Lemur uses static IV per key","description":"Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.","status":"published","published":"2022-05-13T01:30:21Z","modified":"2026-09-10T03:49:22.227010371Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"PYSEC-2017-50","description":"Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.","status":"published","published":"2017-08-09T16:29:00Z","modified":"2026-06-10T17:02:00.314087755Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}