CVE-2017-5999

HIGH

syspass 2.x - Inadequate Encryption Strength via MCRYPT_RIJNDAEL_256

Title source: llm
STIX 2.1

Description

An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPT_RIJNDAEL_256() function (the 256-bit block version of Rijndael, not AES) instead of MCRYPT_RIJNDAEL_128 (real AES) could help an attacker to create unknown havoc in the remote system.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_misc
https://cxsecurity.com/issue/WLB-2017020196
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96562
Patch, Release Notes x_refsource_confirm
https://github.com/nuxsmin/sysPass/releases/tag/2.1.0.17022601

Scores

CVSS v3 7.5
EPSS 0.0114
EPSS Percentile 62.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-326
Status published
Products (1)
syspass/syspass 2.0
Published Mar 06, 2017
Tracked Since Feb 18, 2026