NetSight
IP …
medium5.9

CVE-2016-6225

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier fo…

Impact

xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.

Affected products

VendorProductAffected versions
PerconaXtrabackup
through 2.3.5
Versions 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4
OpensuseLeap
Versions 42.1, 42.2
FedoraprojectFedora
Versions 24, 25

Weakness classification

CWE-326

References