Vulnerability in Elixir package: CVE-2012-2146
Summary
CVE-2012-2146: Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database. Affects elixir versions < 0.7.1-4. Fixed in 0.7.1-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elixir is a package used in the Debian 10 ecosystem. It provides functionality for various purposes and includes a database component. However, the Elixir 0.8.0 version has a vulnerability that affects its usage of Blowfish in CFB mode. This vulnerability arises from the absence of a unique initialization vector (IV) during encryption. As a result, context-dependent users can exploit this weakness to obtain sensitive information and decrypt the database.
Vulnerability Detail
The vulnerability (CVE-2012-2146) in Elixir 0.8.0 allows unauthorized users to access and decrypt the database due to the lack of a unique initialization vector (IV) when using Blowfish in CFB mode. This vulnerability poses a risk to the confidentiality of sensitive information stored in the database. Attackers with access to the encrypted data can exploit this weakness to obtain the original plaintext information.
How To Fix
Minimum fixed version
0.7.1-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade elixirTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Elixir package version 0.8.0 has a vulnerability (CVE-2012-2146) that allows unauthorized users to decrypt the database and access sensitive information. To mitigate this risk, it is crucial to upgrade to version 0.7.1-4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for elixir →
FAQ
The vulnerability allows unauthorized users to decrypt the database and access sensitive information stored within.
The vulnerability affects Elixir version 0.8.0.
You can use Vulert's playground at Vulert Scanner to check if your Elixir package is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
Yes, upgrading the Elixir package to version 0.7.1-4 or later will fix this vulnerability.
There are no known exploits for this vulnerability at this time.
Related vulnerabilities
Recent vulnerabilities recorded for elixir.
