CVE-2015-7764

Description

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• http://www.openwall.com/lists/oss-security/2015/10/20/3
• https://github.com/Netflix/lemur/issues/117
• https://github.com/kvesteri/sqlalchemy-utils/issues/166
• https://nvd.nist.gov/vuln/detail/CVE-2015-7764
• https://github.com/Netflix/lemur/commit/394e18f76e5eb534d95160945ebc231ec3b4c794
• https://github.com/Netflix/lemur
• https://github.com/pypa/advisory-database/tree/main/vulns/lemur/PYSEC-2017-50.yaml

CWEs

CWE-331