Description
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | lemur | < 0.1.5 | 0.1.5 | GHSA-chg9-3c3p-ch23 |
| PyPI | lemur | < 0.2.1 | 0.2.1 | PYSEC-2017-50 |
High · 7.5
CVE-2015-7764
EUVD-2017-0069GHSA-chg9-3c3p-ch23PYSEC-2017-50
Lemur uses static IV per key
Published Aug 9, 2017 · Updated Aug 6, 2024 · Assigned by mitre