CVE-2016-7798 describes a critical vulnerability in the Ruby openssl gem, specifically affecting its GCM Mode (aes-*-gcm) implementation when the initialization vector (IV) is set before the key. This flaw allows context-dependent attackers to bypass encryption protections, impacting Debian Linux and Ruby applications utilizing the affected openssl gem. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to a complete compromise of confidentiality. While there is no evidence of active exploitation, nor publicly available exploit code or significant community discussion, the high severity warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.0.0CPE matchmatch criteria | cpe:2.3:a:ruby-lang:openssl:*:*:*:*:*:ruby:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2016-7798
Sep 8, 2020OpenSSL gem for Ruby using inadequate encryption strength
Oct 24, 2017The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
Jan 10, 2017ruby: IV Reuse in GCM Mode
Sep 19, 2016