CWE-329: Generation of Predictable IV with CBC Mode
The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
A kind of CWE-1204 Generation of Weak Initialization Vector (IV).
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.0 Medium
- No product listed CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors... 7.5 High
- red hat directory server 11, directory server 12, directory server 13 +8 more +10 more 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption 4.4 Medium
- bixilon minosoft Minosoft has IV equal to key 5.0 Medium
- electerm electerm's encrypt method not safe enough 6.0 Medium
- red hat enterprise linux 10, enterprise linux 9 +1 more Keylime: keylime: security bypass due to hardcoded tpm quote nonce 6.3 Medium
- ibm openpages with watson IBM OpenPages with Watson information disclosure 5.3 Medium
- lds crypt::cbc Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions 4.0 Medium
- lfprojects vector packet processor FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06, 21.01, 20.09, 20.05, 20.01... 7.5 High
- fortinet fortios, fortiproxy +1 more A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and... 3.1 Low
- ypsomed mylife, mylife cloud +1 more Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7... 5.9 Medium
- pivotal software spring security, spring security +1 more Dictionary attack with Spring Security queryable text encryptor 6.5 Medium
- das u-boot Das U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data 6.4 Medium
- das u-boot Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data 4.6 Medium
- openssl, apple mac os x, debian linux +17 more +19 more The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic... 3.4 Low
- openbsd openssh, ssh tectia client, tectia connector +2 more +4 more Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through... 2.6 Low