CVE-2017-12871

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-12871
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12871.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-12871
Aliases
Downstream
Published
2017-09-01T21:29:00.530Z
Modified
2026-03-15T14:24:40.608336Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).

References

Affected packages

Git / github.com/simplesamlphp/simplesamlphp

Affected ranges

Type
GIT
Repo
https://github.com/simplesamlphp/simplesamlphp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
03c6303dfee814450836c4ee3d07d51e628e4d4e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9af219af82f3c9d10b7fa0e2024f15d5530b86fb
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6927093deeebe12e96cbb87557d25a15ad96f93c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1e274725507ef44857f53b3bf43af561200dd463
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8c030903d44a2afbc5d03d22ce1d637aba680313
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0542f79c24b7ec30f4d66cec34a005b09f3117c0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c384d723f240c4b3cafadc43f7ab1dd87aaffbe4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f5ff7c4643b9b784957f5e1fbf86fc740cd6b78a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
44f617fb581b8f7ceea7b535d521698db69bba42
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
247d316baf7475b3362ba5ef0f835176aca6d7fb
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
da637c53962c13905eaae5ec9f33e658a237c284
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b96dcc500caae73954d4f01189e0209afc6086be
Fixed
77df6a932d46daa35e364925eb73a175010dc904
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.14.11"
        }
    ]
}

Affected versions

v1.*
v1.12.0
v1.14.0
v1.14.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12871.json"