CVE-2012-2146: Elixir 0.8.0 Blowfish CFB Mode Initialization Vector Vulnerability
Summary
CVE-2012-2146: Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database. Affects elixir versions 0.1.0 – 0.7.1. No fix is published. How to fix ↓
Also tracked for
- elixir · Debian:10
The same CVE-2012-2146 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elixir is a Python package available on PyPI that provides a simple and intuitive way to work with databases. It offers an object-relational mapping (ORM) layer for interacting with databases, allowing developers to define database models and perform CRUD operations. Elixir 0.8.0 is a specific version of the Elixir package. This version utilizes Blowfish encryption in Cipher Feedback (CFB) mode for encrypting sensitive data stored in the database.
Vulnerability Detail
The vulnerability in Elixir 0.8.0 lies in its improper usage of Blowfish in CFB mode. It fails to generate a unique initialization vector (IV) for each encryption operation, making it easier for context-dependent users to obtain sensitive information and decrypt the database. This vulnerability poses a significant risk as it compromises the confidentiality of the stored data, potentially leading to unauthorized access and exposure of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating to a patched version of Elixir.
Conclusion
In conclusion, the Elixir 0.8.0 package utilizes Blowfish encryption in CFB mode without constructing a unique initialization vector (IV), making it susceptible to unauthorized decryption of the database. To mitigate this vulnerability, users should update to a patched version of Elixir that addresses the issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for elixir →
FAQ
This vulnerability allows context-dependent users to obtain sensitive information and decrypt the database, potentially leading to unauthorized access and exposure of sensitive data.
No, there is no known workaround for this vulnerability. It is essential to update to a patched version of Elixir.
Elixir 0.8.0 is affected by this vulnerability. Users of this specific version should upgrade to a patched version.
Yes, the Elixir development team has released a fix in a subsequent version that generates a unique IV for each encryption operation. Users should upgrade to the latest version or a version that includes the fix.
You can find more information about this vulnerability in the Elixir advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/elixir/PYSEC-2012-13.yaml
Related vulnerabilities
Recent vulnerabilities recorded for elixir.
