Vulnerability advisory

GHSA-h7qw-mxrm-c6h2

Unauthenticated crypto and weak IV in Magento\Framework\Encryption

Published Nov 20, 2019Updated Feb 10, 2025OSV record ↗

Also known as CVE-2016-6485

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected Fixed in

2.0 to before 2.2.6 2.2.6Advisories →

Affected	Fixed in
`2.0` to before 2.2.6	`2.2.6`Advisories →
Also listed as affected (49) `2.0.0` `2.0.0-rc` `2.0.0-rc2` `2.0.1` `2.0.10` `2.0.11` `2.0.12` `2.0.13` `2.0.14` `2.0.15` `2.0.16` `2.0.17` `2.0.18` `2.0.2` `2.0.3` `2.0.4` `2.0.5` `2.0.6` `2.0.7` `2.0.8` `2.0.9` `2.1.0` `2.1.0-rc1` `2.1.0-rc2` `2.1.0-rc3` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.16` `2.1.17` `2.1.18` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9` `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5`

Also listed as affected (49)

magento/project-community-edition Packagist

All magento/project-community-edition advisories →

Affected	Fixed in
`2.0` through `2.0.2`	No fix listed
Also listed as affected (5) `2.0.0` `2.0.0-rc` `2.0.0-rc2` `2.0.1` `2.0.2`

Description

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2016-6485 ↗
Webgithub.com/magento/magento2/pull/15017 ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2016-6485.yaml ↗
Webwww.openwall.com/lists/oss-security/2016/07/19/3 ↗
Webwww.openwall.com/lists/oss-security/2016/07/27/14 ↗