high7.5
CVE-2015-7764
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
Impact
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netflix | Lemur | Version 0.1.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2015/10/20/3
- https://github.com/Netflix/lemur/issues/117
- https://github.com/kvesteri/sqlalchemy-utils/issues/166
- http://www.openwall.com/lists/oss-security/2015/10/20/3
- https://github.com/Netflix/lemur/issues/117
- https://github.com/kvesteri/sqlalchemy-utils/issues/166