7.5
CVE-2022-46397
- EPSS 0.62%
- Veröffentlicht 28.03.2023 22:15:09
- Zuletzt bearbeitet 19.02.2025 19:15:11
- Erkennungen
LoginFP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06, 21.01, 20.09, 20.05, 20.01, 19.08, and 19.04 Generates a Predictable IV with CBC Mode.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lfprojects ≫ Vector Packet Processor Version 19.04
Lfprojects ≫ Vector Packet Processor Version 19.08
Lfprojects ≫ Vector Packet Processor Version 20.01
Lfprojects ≫ Vector Packet Processor Version 20.05
Lfprojects ≫ Vector Packet Processor Version 20.09
Lfprojects ≫ Vector Packet Processor Version 21.01
Lfprojects ≫ Vector Packet Processor Version 21.06
Lfprojects ≫ Vector Packet Processor Version 21.10
Lfprojects ≫ Vector Packet Processor Version 22.02
Lfprojects ≫ Vector Packet Processor Version 22.06
Lfprojects ≫ Vector Packet Processor Version 22.10
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.62% | 0.45 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| CISA-ADP | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-329 Generation of Predictable IV with CBC Mode
The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
https://lists.fd.io/g/security-announce/message/2
https://s3-docs.fd.io/vpp/23.02/