Overview
About vulnerability
This is a continuation of [CVE-2020-5408](https://spring.io/security/cve-2020-5408).
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Because the IV is fixed, identical plaintexts always produce identical ciphertext for a given password and salt, regardless of when or how many times the value was encrypted.
An attacker with read access to the encrypted data store can exploit this property to determine when two records share the same plaintext value, correlate encrypted values across rows or users, and mount dictionary attacks by pre-encrypting candidate values and comparing the results.
Details
- Affected product:
- Apache CXF , Spring , grails-core
- Affected packages:
- cxf-archetypes @ 3.5.9 (+1221 more)